Is OneDrive a backup? Why sync and recycle bins fall short

OneDrive and Google Drive are built to keep the same files available on a laptop, a phone and the web. When someone edits, renames or deletes a file in one place, the service copies that change everywhere else. That behaviour is what makes shared working easy, and it is also why a sync folder cannot protect you from your own mistakes.

A backup is a separate copy, held somewhere the original cannot reach, that you can return to after something goes wrong. The NCSC says organisations should not rely solely on cloud-service version history or deleted-file recovery for critical data, and should keep an independent copy in another safe place or service. The same advice applies to both OneDrive and Google Drive.

Suppose a member of staff clears out an old client folder in the OneDrive folder on their laptop. The deletion syncs to the cloud, then to every colleague who shares that folder. A ransomware infection on one laptop works the same way: encrypted files are uploaded as the new current version and replace the clean ones.

The recycle bin and version history can often reverse this, but only within limits set by the service. Those limits can include how long deleted items are kept, how many versions are held, and whether the person who needs the file still has permission to see the bin. The NCSC describes this recovery as limited and not a substitute for a reliable backup, so treat it as a first aid kit rather than a hospital.

Most small businesses discover a retention limit only when they need something that has already aged out. A spreadsheet corrupted three weeks ago, a folder deleted before a long holiday, or a contract overwritten by an old version can all fall outside the recovery window by the time anyone looks.

The NCSC recommends retaining backups for longer than a single rolling copy, at least a month, so that you can step back past the point where a problem started. Check what your Microsoft 365 or Google Workspace plan actually retains for deleted files and prior versions, and compare that with how quickly your business would notice a quiet loss.

A backup that lives inside the same tenant as the data shares the same weak point: the administrator login. If an attacker phishes a global administrator, or a disgruntled leaver still holds admin rights, they can delete files, empty recycle bins and remove the retention settings that would have saved you. The ICO's ransomware guidance asks organisations to assess whether backups are offline or segregated, who can alter or delete them, and whether changes or deletions would be detected.

The practical answer is separation. Keep at least one copy that is not reachable through the main network or the primary admin account, and make sure previous versions are protected from accidental or malicious deletion. Limit the number of people with administrator rights, protect those accounts with multi-factor authentication, and make the credentials for the backup service different from the ones used for daily work.

Start by listing the data the business could not operate without: client records, finance files, contracts, shared mailboxes and the configuration needed to rebuild systems. The NCSC advises backing up essential data together with the configuration data needed to operate systems, keeping multiple copies in different locations. Then choose a third-party cloud-to-cloud backup tool or a separate storage target that sits outside your Microsoft 365 or Google Workspace admin control.

For the independent copy, work through the setup in the order below. The exact menu names vary by product, but the sequence holds.

A backup you have never restored is an assumption. Schedule a restore test at least twice a year: pick a folder and a mailbox at random, recover them to a clean location, and record how long it took and whether the files opened. UK GDPR expects you to be able to restore availability and access to personal data in a timely manner after a physical or technical incident, and a dated test record is the clearest evidence that you can.

Backups also hold personal data, so consider erasure requests. The ICO says organisations must think about how a valid request applies to backup systems, including the retention schedule, and may put the data beyond use until it is replaced under that schedule. Document that approach in your retention policy so a request received next year is handled consistently.