Skip to main content Skip to page navigation

In association with

Storing and protecting data

There are many ways to store and protect your business data, from laptops and mobile phones to the cloud. Here’s advice on finding the best option for your business.

Work out your data storage needs

The amount and type of data you need to store will depend on your line of work. Knowing what you have and how you use it are key to finding the best storage option.

Data types

The first step is to list data you have in paper records, stored electronically or on devices you use in your business. The second step is to identify what you need to run your business — what you couldn’t do without or find elsewhere if needed. This could include:

  • emails
  • bills
  • invoices
  • receipts
  • tax records
  • employment records
  • customer details — contact details, bank accounts and payment details
  • sales records
  • documents
  • spreadsheets
  • contracts.

Data use

Next, ask yourself who needs access to the data. Whether you share documents with one or two people or collaborate in teams, make sure your storage solution allows the right access at work and offsite. You’re unlikely to need to store most information for more than a couple of years. But some data needs to be kept for longer.

You must keep tax records for seven years.

You must keep tax records for seven years.

Find out more about the rules for keeping tax records and employment records.

Online storage in the cloud

Many businesses use the cloud — the network of servers hosted on the internet — to store, manage and process at least some of their data. Examples include Google Drive, Dropbox and iCloud.

When looking to sign up to a cloud service, it’s a good idea to compare what’s on offer. Think about the following:


Benefits: You should be able to access data anywhere and anytime you can get online, including on a smartphone.

Ask about: Can you easily and securely collaborate on documents with colleagues and clients, eg for day-to-day business and projects?


Benefits: If misfortune strikes, eg a breach of your IT system or devices by a hacker or a major natural disaster, your data should be safe in the cloud. Most cloud services are very secure — their businesses depend on it.

Ask about: Data security. Even if you’re no IT expert, you should still feel confident about what you’re getting. For example, ask the service provider about any security breaches and its strategies for stopping them. If the answers don’t satisfy you, maybe that service isn’t for you.

You can also ask if it meets the New Zealand standard for information security management. This standard is coded ISO/IEC 27002— find out more about it on the Standards New Zealand website (external link)


Benefits: Weigh up how much future storage you’ll need. The cloud can be cheaper when it comes to scaling up your needs.

Ask about: There should be a range of prices depending on how much you want to store and service level. Also ask about special offers for signing up. If you can’t negotiate on price, you can still compare prices between services.


Benefits: Cloud services often offer levels of service that cater for a range of business sizes and budgets, eg if you don’t need on-call 24-hours-a-day support, the costs should be much lower.

Ask about: If looking at an overseas service with different business hours to New Zealand’s, does this affect response times to queries?

Changing service

Benefits: It’s usually very easy to change services. Notice times will be in your contract.

Ask about: If you want to switch providers, what happens to your data? How easy/secure is it to transfer it?

Other things to think about

Reputation: Check the service’s reputation by doing an online search of its name and words like“ privacy” and “ breach”.

Location:Privacy rules can vary between countries. If your business is concerned about privacy, ask where your data will be stored.

Cloud computing checklist for small business (external link) — Privacy Commissioner

You can usually try before you buy a cloud service. Test it with data that’s not confidential.

You can usually try before you buy a cloud service. Test it with data that’s not confidential.

Other storage options

There are ways for small businesses to store data including:

Personal computer: If you don’t have lots of data, a PC hard drive is an option. Large amounts of data on a PC can dull its performance, but you can boost storage if needed. As it’s connected to the internet, think about how you’ll guard against hackers.

Server: A much more powerful hard drive used to provide a business with its own network. You’ll need IT help to maintain one. Think about how you’ll guard against hackers. It’s also a good idea to restrict administrator-level access — and to have a secure password that’s different from others your business uses.

External hard drive: These offer more storage than a PC, and are relatively cheap and easy to transport — a good option for backing up data and offsite storage.

USB drive: Also known as a USB stick or flash drive, they’re small and can store moderate amounts of data — an option for backup copies or for working offsite.

Disc: DVDs and CDs can store moderate amounts of data and can be useful as backups to keep offsite.

Storing data on a hard drive is not without risk — if it gets damaged or lost, so could your data.

Storing data on a hard drive is not without risk — if it gets damaged or lost, so could your data.

Always keep multiple copies in different locations.

Copy all your data

You should regularly make copies of data — known as backing up — in case original data is lost or stolen. It’s also vital for your disaster recovery . If you store data in the cloud, this should be done for you. If not, look at getting software that backs up data automatically, so you don’t need to think about it.

Tips for backing up

  • Do it regularly: If it’s not automated, back up your system at least daily.
  • Secure it: Protect files with passwords, which should be noted and kept securely at work and offsite.
  • Back up everything: This includes any device used for your business, eg smartphones, tablets and computers.
  • Keep several copies: Store copies of backups in different locations — physically and/or in the cloud — to spread the risk.
  • Test it: Check your back-up process works by trying to retrieve stored data. When you’re happy it works, set a schedule to test regularly.

Ask yourself if you’re making it easy for unauthorised people —hackers — to get access to your data. Here are some options for protecting it.


  • Always use strong passwords to protect your devices and data.
  • Change any password that comes with a new device as soon as you get it — see Safety tips for mobiles on the Digital Resources website.
  • Don’t use the same password for all your systems or staff. Hackers could get access to all your most sentive information in one hit.
  • Do not store your passwords on your online systems or devices — this makes them too easy to find. 
  • Use longer passwords — at least eight characters — made up of random letters and numbers. These are harder to guess than birthdays and pets’ names.

How cyber secure is your website? (external link) — Connect Smart

Don’t leave factory or administrator passwords in place on your wifi, modem or any devices.

Don’t leave factory or administrator passwords in place on your wifi, modem or any devices.

Change these to strong passwords — and change the passwords each time someone who knew them leaves the business.


Add a further security layer by encrypting data with a key. A cloud service will do this for you, as doing it yourself can be time-consuming and costly.

Antivirus and malware protection software

Installing antivirus software on computers is an easy way to protect your data. Keep your software up to date to fight off the latest malware. Install patches and updates from your internet service provider.

Consider getting protection from malware, a term covering a range software threats, including:

  • viruses — code that can copy itself and infect computers and other devices
  • trojan horses — programs designed to breach and take over parts of a system
  • ransomware — software that blocks access to a computer until a ransom is paid
  • spyware — software used to secretly get information sent from a computer about how it’s being used 
  • adware — software that automatically downloads or displays often unwanted adverts.

The Digital Resources website has more tips on antivirus software (external link) and security.

SME toolkit (external link) - Connect Smart.

Online behaviour

Security breaches are often caused by an employee doing something they shouldn’t, usually inadvertently. If your people use computers and mobiles devices at work, create a usage policy — see the Internet and social media clause in our Employment Agreement Builder for tips on what to include — and provide training on how to keep data and systems safe.

Wherever you store personal information, your customers trust you to protect it.

Wherever you store personal information, your customers trust you to protect it.

If your business holds information about people, eg customer contact details, you must handle it carefully. The Privacy Act has guidelines to help businesses handle personal information, including:

  • Only collect information if you really need it
  • Use it for the purpose you got it for
  • Get it from the person concerned
  • Tell them why you want it and what you'll do with it
  • Collect it legally and fairly
  • Look after it
  • Make sure the people concerned can access it
  • Get rid of it when you're done — and make sure you dispose of it securely.

Your privacy obligations (external link) — Privacy Commissioner

How helpful was this information?