Why local backup is not enough
Many South African businesses run daily backups to an external hard drive or a NAS device on the same premises as their primary systems. This protects against individual file deletion or drive failure — but it doesn't protect against the scenarios that cause the most damage.
A ransomware attack encrypts every connected drive simultaneously, including your local backup device. A fire, flood or theft removes your backup along with your primary systems. A power surge during load shedding can destroy multiple devices on the same circuit.
Off-site cloud backup protects against all of these scenarios because your backup exists in a geographically separate, purpose-built data centre — physically and logically isolated from your office.
The 3-2-1 rule. Security best practice requires three copies of data: two on different local media types, one off-site. Cloud backup fulfils the off-site requirement and often the most critical one — it's the copy you'll reach for when everything on-premise is gone.
Where your backup data lives matters
When a backup provider stores your data offshore, two things suffer: restore speed and POPIA simplicity. A full server restore pulled from a European data centre over a South African business fibre line takes materially longer than one pulled from a Johannesburg or Cape Town facility with local peering. And POPIA's cross-border transfer rules (Section 72) add documentation overhead the moment personal information leaves the country.
M.Y Tech Guys configures backup vaults in South African data centres first, with EU-based storage as the secondary option where retention economics favour it — always with a documented data processing agreement either way. If a provider can't tell you which city your data sits in, that's your answer.
We deploy and support cloud backup for businesses in Johannesburg, Cape Town, Durban and everywhere between — the service is remote-first by nature, and restore testing happens wherever your servers are.
What cloud backup covers
A properly configured cloud backup solution protects:
- File and folder backup — documents, spreadsheets, databases, design files and any other business-critical data
- Server image backup — a full snapshot of your Windows or Linux server, restorable to the same or different hardware
- Microsoft 365 backup — emails, SharePoint, OneDrive and Teams data (Microsoft's default retention is not a backup — it doesn't protect against accidental deletion or ransomware spreading to OneDrive)
- SQL database backup — transactional databases with point-in-time recovery to any previous state
- Virtual machine snapshots — VMware, Hyper-V and cloud VM backups with application-consistent recovery
Backup frequency ranges from continuous (every 15 minutes for critical systems) to daily (for less volatile data), and retention periods from 30 days to 7 years for compliance purposes.
POPIA and cloud data storage in South Africa
POPIA requires that personal information is processed and stored with appropriate security controls. For cloud backup, this means:
- Encryption — backups must be encrypted in transit (TLS) and at rest (AES-256). M.Y Tech Guys configures encryption keys controlled by your organisation, not the backup provider.
- Access controls — who can initiate, view or restore a backup must be documented and audited. Shared credentials are not compliant.
- Data residency — if backup data crosses South Africa's borders, POPIA requires either that the destination country has adequate protection laws or that you have explicit consent from data subjects. M.Y Tech Guys uses South African or EU-based data centres with documented data processing agreements.
- Retention and deletion — POPIA requires that personal data is not kept longer than necessary. Backup retention policies must be set and enforced, with expired backups deleted on schedule.
How to choose a backup provider in South Africa
Five questions that separate a real backup service from rented disk space:
- Where is the data centre? Local residency means faster restores and simpler POPIA compliance.
- Is the storage immutable? If ransomware holding your admin credentials can delete the backup, it isn't a backup.
- When was the last restore test — and can you see the report? A backup that has never been restored is a hope, not a plan.
- What are the RTO and RPO? How long until you're running again, and how much recent work you can afford to lose. If the provider can't state both per tier, they haven't designed for recovery.
- Who monitors failures? Backup jobs fail silently all the time. Daily verification with a human escalation path is the difference between a managed service and a script.
Cloud backup pricing in South Africa
Cloud backup pricing depends on the volume of data, the frequency of backups and the retention period. M.Y Tech Guys provides fully managed backup as part of IT support contracts or as a standalone service.
| Tier | Backup interval (RPO) | Retention | Restore testing |
|---|---|---|---|
| Essentials · R2,500/m | Daily | 30 days | Annual restore test |
| Business · R6,500/m | Every 4 hours (critical data) | 90 days | Quarterly DR test + report |
| Enterprise · R15,000/m | Continuous (15-minute RPO) | 7 years | Monthly failover test |
R2,500/month
Essentials Backup. File and folder backup for up to 500GB. Daily backups, 30-day retention, M365 mailbox backup, daily verification alerts and annual restore test. Encrypted with AES-256.
R6,500/month
Business Backup. Everything in Essentials plus server image backup (up to 2TB), 90-day retention, 4-hourly backup intervals for critical data, SQL database backup and a quarterly DR test with a written report.
R15,000/month
Enterprise Backup and DR. Unlimited data volume, 7-year retention for compliance, continuous backup (15-minute RPO), virtualisation support, dedicated DR runbook and monthly failover testing. Includes POPIA data residency documentation.
Frequently asked questions
What is the difference between backup and disaster recovery?
Backup is copying your data to a secure location. Disaster recovery is the full plan for restoring operations after a major incident — it includes backups but also defines who acts, in what sequence, and what the recovery time targets are.
How long does a backup restore take?
Single file restores take minutes. A full server image restore from cloud typically takes 4 to 24 hours depending on data volume and your internet connection speed. Critical systems can be configured for faster recovery using local caching or hot-standby cloud instances.
Is cloud backup POPIA compliant?
Yes, when configured with AES-256 encryption, access controls, documented data residency and enforced retention policies. M.Y Tech Guys provides POPIA documentation for all managed backup services.
How much does cloud backup cost in South Africa?
Fully managed backup starts from R2,500 per month for small businesses. Enterprise tiers with DR testing and compliance documentation run to R15,000 per month. Storage-only (unmanaged) runs from R500 to R1,500 per month depending on volume, but without monitoring or testing it is not a reliable recovery strategy.
Does cloud backup protect against ransomware?
Yes, if the backup destination is immutable — meaning the attacker cannot encrypt or delete the backup. M.Y Tech Guys configures backup vaults with immutability locks and separate credentials so that a compromised on-premise environment cannot reach the backup copy.
Which is the best online backup for a South African small business?
The best backup is the one that restores. For most SA small businesses that means South African data residency, AES-256 encryption with immutability, daily automated verification, and a provider who actually runs restore tests. Storage-only products from R500/month meet none of the last three; managed backup from R2,500/month exists precisely to close that gap.