Backup means keeping recoverable copies of your business data. Disaster recovery means being able to operate again after you need those copies. South African businesses need both: POPIA requires safeguards against loss and damage of personal information, and Interpol's 2026 African Cyberthreat Assessment found South Africa accounted for the overwhelming majority of the continent's ransomware detections in 2025.
Most businesses discover the state of their backups on the worst possible day. A laptop is stolen from a car in Woodstock. A bookkeeper deletes the wrong folder. A supplier's compromised email leads to encrypted file shares on a Friday afternoon. In each case the question is identical, and it is never "do we have a backup?" It is "how far back does it go, and how long will it take to get working again?"
Those two questions have names — RPO and RTO — and answering them honestly is most of the work. This guide covers what to protect, what the law expects, how to set recovery targets you can afford, and what it costs in rands.
What is the difference between backup and disaster recovery?
A backup is a copy. Disaster recovery is a plan for using it.
Think of it like a spare key. Having a spare key to your building is a backup. Knowing who holds it, how quickly they can get to the door, and what happens if the lock itself was changed — that is disaster recovery. Businesses that own the copy but not the plan still lose days.
The practical distinction shows up in three places:
- Scope. A backup protects data. Disaster recovery protects the ability to trade — data, plus the environment it runs in, plus the people who know the sequence.
- Testing. A backup that has never been restored is an assumption. Disaster recovery is where you convert it into a fact.
- Ownership. Backups are often assumed to be "IT's job". Recovery decisions — which systems come back first, what you tell customers — belong to the business.
Why is data loss a bigger risk for South African businesses right now?
Three pressures compound locally.
We are a concentrated target. Interpol's 2026 African Cyberthreat Assessment identified South Africa as the continent's primary cybercrime target, with the country accounting for roughly 92% of African ransomware detections recorded in 2025 — a consequence of high connectivity, subsea cable landings and dense data centre infrastructure. Attractive infrastructure attracts attention.
Modern ransomware hunts backups first. Attackers now target backup repositories deliberately, because a business with clean, reachable backups does not pay. This is why the old 3-2-1 rule (three copies, two media types, one offsite) has become 3-2-1-1: one of those copies must be immutable — written once, unchangeable and undeletable for a fixed retention window, even by an administrator account.
Sync is not backup. OneDrive, Google Drive and Dropbox replicate changes. That is their job. A deletion syncs. An encryption event syncs. Replication faithfully reproduces your mistake across every device you own.
What does POPIA actually require you to do about backups?
POPIA does not contain a clause that says "back up your data nightly". It does something more demanding: it makes you responsible for the outcome.
Section 19 requires responsible parties to secure the integrity and confidentiality of personal information by taking reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction of personal information — and to regularly verify that those safeguards are effectively implemented and updated as risks change. Losing your only copy of customer records is a Section 19 failure, whether the cause was a criminal or a coffee spill.
Section 22 adds the part that hurts publicly. Where there are reasonable grounds to believe personal information has been accessed or acquired by an unauthorised person, you must notify the Information Regulator and the affected data subjects as soon as reasonably possible, in writing, with enough detail for them to protect themselves.
Enforcement is real but proportionate. The Regulator's route is complaint or investigation, then an enforcement notice, then an administrative fine of up to R10 million — imposed in practice when the notice is ignored. The first such fine, R5 million, was issued to the Department of Justice and Constitutional Development in 2023 after a security compromise and a failure to comply with an enforcement notice. (A separate reporting duty under Section 54 of the Cybercrimes Act, aimed at electronic communications service providers and financial institutions, has not yet commenced.)
The practical reading: document your safeguards, test them, and be able to show your work. We cover the wider compliance picture in our POPIA guide.
What should you actually be backing up?
Most gaps sit in systems people assume are already covered.
| System | Who is responsible for your data | What the native tools typically give you | What you still need |
|---|---|---|---|
| Microsoft 365 / Google Workspace | You. The provider protects the platform and its uptime — not your content | Recycle bin and limited retention, commonly around 30 days, clearable by an admin | Third-party backup with retention that matches your record-keeping obligations |
| Custom web app and its database | You, jointly with your development partner | Varies entirely by hosting plan — often nothing by default | Automated daily database snapshots plus one offsite, immutable copy |
| Accounting, payroll and invoicing | Vendor for the platform; you for the records | Vendor-side snapshots you cannot usually access directly | Your own periodic exports — SARS requires records be kept for five years |
| Laptops, desktops and phones | You | Cloud sync folders (sync is not backup) | Endpoint backup, or an enforced policy that nothing of value lives only on a device |
| Website and CMS | Host, partially | Host snapshots, often 7–14 days | An independent copy stored away from the host |
The pattern is consistent: cloud platforms guarantee their availability, not your content. That is the shared responsibility model, and it is written into the terms you have already accepted.
Not sure where your gaps are? A 30-minute discovery call is usually enough to map every system holding your business data and identify which ones have no recoverable copy. No obligation, no sales script.
How do you set an RTO and RPO you can actually afford?
Two numbers turn a vague worry into a budget.
- RPO (Recovery Point Objective) — how much data you can afford to lose, measured in time. It sets your backup frequency. An RPO of 24 hours means a nightly backup and a willingness to re-key a day's work.
- RTO (Recovery Time Objective) — how long you can afford to be down. It sets your architecture. An RTO of four hours cannot be met by restoring from cold storage over a fibre line.
Do not set one number for the whole business. Tier your systems instead.
| Tier | Typical systems | Sensible RPO | Sensible RTO | What it takes |
|---|---|---|---|---|
| 1 — Revenue stops | Point of sale, checkout, booking engine, core operations platform | 15 minutes or less | 4 hours or less | Replicated database, warm standby environment, documented and rehearsed failover |
| 2 — Work stops | CRM, email, project and job management, finance | 24 hours or less | 4–24 hours | Automated daily backup, offsite immutable copy, written restore runbook |
| 3 — Inconvenient | Archives, marketing assets, historical reporting | 1 week or less | 1–5 days | Weekly snapshot to low-cost object storage |
Two rules make this exercise honest. First, cost rises sharply as RTO approaches zero — every hour you shave costs more than the last. Second, an untested target is a wish. If nobody has restored the system in the past six months, treat the RTO as unknown.
Businesses running on one connected platform have a structural advantage here: there is a single data estate to protect rather than nine disconnected tools each with their own export quirks. That is one of the quieter arguments for consolidating operations onto a Business OS.
What does backup and disaster recovery cost in South Africa?
Indicative ranges below, excluding VAT. Treat them as orientation, not a quote — the honest number depends on data volume, how fast you need to be back, and how much is bespoke.
| Approach | What it covers | Indicative monthly cost |
|---|---|---|
| Local object storage (self-managed) | Raw storage; you write and maintain the scripts | From roughly R0.30 per GB per month |
| SaaS backup add-on | Microsoft 365 or Google Workspace mail, files and Teams/SharePoint | Roughly R40–R90 per user per month |
| Managed backup for a small team | Around 20 users plus a file server, with monitoring and tested restores | Roughly R2,000–R6,000 per month |
| Warm standby for a critical application | A second, smaller copy of your production environment, kept current | Scoped per environment — book a scoping call for a fixed quote |
Weigh this against the cost of the alternative in your own numbers: daily revenue, hourly staff cost, the value of the customer records you cannot reconstruct, and the notification obligations that follow a breach. For most SMEs the monthly backup spend is smaller than a single day of standing still.
How do you build a disaster recovery plan in one afternoon?
You do not need a 40-page document. You need one page that a stressed person can follow.
- List every system that holds business data. Include the spreadsheets. Include the WhatsApp group where quotes get approved.
- Assign each one a tier using the table above. Be ruthless — most businesses have two or three Tier 1 systems, not ten.
- Record where each backup lives, how often it runs, and who has the credentials. If the answer is "the developer who left in 2023", you have found your first action item.
- Verify the immutable copy. One copy must be beyond the reach of a compromised admin account.
- Write the restore runbook. Numbered steps, named owner, expected duration, and who tells customers what.
- Schedule a restore test. Quarterly for Tier 1, annually for the rest. Put it in the calendar with a person's name on it.
- Review after every material change — a new system, a new integration, a departure.
Then make it visible. Backup health and last-restore-test dates belong on the same executive dashboard as cash and pipeline, because they carry the same category of risk. Financial records deserve particular attention given retention obligations — see how we handle tax-compliant invoicing and finance.
What if your systems were built for you?
If you run bespoke software, backup and recovery are architectural decisions, not an add-on you buy afterwards. Ask your development partner four questions, and expect specific answers:
- What is the current RPO and RTO for each environment?
- Where do backups live, and is one copy immutable and geographically separate?
- When was the last full restore test, and what did it reveal?
- If your team disappeared tomorrow, could ours recover the system from the documentation alone?
The last question is the real one. At Syniq, recovery procedures ship as part of the build for every custom software project — documented, tested and handed over, because software you cannot restore is software you do not own.
Frequently asked questions
Does POPIA require businesses to back up their data? Not in those words. POPIA Section 19 requires reasonable technical and organisational measures to prevent loss, damage or unauthorised destruction of personal information, and requires you to verify that those measures work. In practice, a documented and tested backup is how you meet that obligation.
Do I need to back up Microsoft 365 or Google Workspace? Yes. Both operate a shared responsibility model: the provider guarantees platform availability and security, while your content remains your responsibility. Native retention is time-limited — often around 30 days — and can be cleared by an administrator account, including a compromised one.
What is the difference between RTO and RPO? RPO is how much data you can afford to lose, measured in time, and it determines how often you back up. RTO is how long you can afford to be offline, and it determines how your systems are architected. RPO looks backwards; RTO looks forwards.
Is cloud sync the same as a backup? No. Sync services replicate changes across devices, which means deletions and ransomware encryption replicate too. A backup is a point-in-time copy you can return to. Useful together — not interchangeable.
How often should we test our backups? Quarterly for anything where downtime stops revenue, and at least annually for everything else. Test the full restore, not just whether the backup file exists. An untested backup is an assumption, not a safeguard.
How much should a small South African business budget for backup? Entry-level object storage starts from roughly R0.30 per GB per month, SaaS backup add-ons run about R40–R90 per user per month, and a fully managed service for a team of around 20 with a file server typically falls between R2,000 and R6,000 per month excluding VAT. Warm standby for a critical application is scoped individually.
Protect what you have built
Backups are unglamorous until the morning they are the only thing standing between you and starting over. The businesses that recover quickly are not the ones with the biggest budgets — they are the ones who decided in advance what "recovered" means, wrote it down, and tested it.
If you would like a clear view of where your data actually sits and what it would take to bring it back, book a no-obligation discovery call. We will map your systems, tier them honestly, and tell you what needs attention first — including the parts that need nothing at all.
Written by Mikhail for Syniq (Pty) Ltd. Syniq is a Cape Town software company building Business OS and custom software for growing South African businesses. Pricing is indicative for August 2026 and moves with provider and exchange-rate changes. Legal information is general guidance, not legal advice — confirm your POPIA position with your attorney.