Backups for personal devices: the 3-2-1 approach

Backing up a computer and phone means turning on each device’s built-in automatic backup, such as iCloud Backup, Android backup, Windows Backup or Time Machine, and keeping at least one more copy somewhere else. A backup is a copy of your important information kept somewhere other than the original. If a phone is lost, a laptop dies, or ransomware locks your files, a backup is what lets you get them back. The Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC) describes a backup as “a digital copy of your most important information”, saved “to an external storage device or to an online server like the cloud.”

This guide explains how to back up a computer and phone: what’s worth backing up, the 3-2-1 rule of thumb, the difference between syncing and backing up, and how automatic backups are switched on for iPhone, Android, Windows and Mac. The Backup Readiness Checklist puts the same steps in a list to tick off.

Why it matters

Devices fail, get dropped in water, are lost or stolen, and sometimes get infected. Without a copy elsewhere, whatever was only on that device is gone. The ACSC’s ransomware page puts it plainly: “If you don’t have a backup, it could be impossible to recover your files.” Its backups page calls backing up “the best way to protect yourself from ransomware and other online threats.”

What to back up

Most people’s irreplaceable data falls into a few groups:

• photos and videos
• documents, such as tax records, scanned certificates and letters
• contacts, messages and notes
• app data, such as game progress or notes kept in a specific app
• settings and saved Wi-Fi networks, which make setting up a replacement phone faster.

Apps themselves can usually be downloaded again. The things you created or received are what matter.

The 3-2-1 rule of thumb

The 3-2-1 rule is a simple way to make sure one accident can’t destroy every copy. Microsoft’s backup guidance puts it as:

• “Have at least 3 copies of important files”
• “On at least 2 kinds of media”
• “And with at least 1 of them being physically located somewhere else”.

In practice, “media” means different kinds of storage, such as the device itself, an external drive and a cloud service. “Somewhere else” protects against a fire, flood or burglary that affects everything in one place; the ATO’s backup tips say: “Keep your offline back up at a different location from your device.” The ACSC’s mobile phone guidance makes a similar point: “Backups of important information should be kept on at least two other devices.”

Why an offline copy matters

Ransomware can encrypt anything a computer is connected to. The ACSC’s small business guide includes a case study in which “There was a backup drive plugged into the computer, which had also been encrypted.” The business then connected more backup drives, and those files “were automatically encrypted within seconds.”

The ATO’s backup tips describe keeping “an offline version of your backup on an external hard drive”, and say: “Disconnect your backup when you’re not using it.” An external drive that is unplugged after each backup is one common way to keep an offline copy.

Syncing is not the same as backing up

Cloud storage services often sync files: a change on one device is copied everywhere. Microsoft explains that changes made locally or in the cloud are “automatically synchronized to the other location.” That’s convenient, but it also means a deletion or a ransomware-encrypted file can be synced too.

Some services keep earlier versions. Microsoft’s OneDrive restore feature “helps Microsoft 365 subscribers undo all the actions” on files and folders “within the last 30 days”, for files that “were deleted, overwritten, corrupted, or infected by malware.” These features are limited in time, which is why the 3-2-1 rule still refers to separate copies.

How to turn on iCloud Backup for an iPhone or iPad

Based on Apple’s instructions (checked October 2026). Menus can change; Apple’s guide has the latest steps.

1. Connect the iPhone to Wi-Fi.
2. Open Settings, tap your name, then tap iCloud.
3. Tap iCloud Backup and turn on Back Up This iPhone.
4. To make a backup straight away, tap Back Up Now and stay on Wi-Fi until it finishes. The date and time of the last backup appear underneath.

Apple says automatic backups need the device to be connected to power and Wi-Fi, with the screen locked. If there isn’t enough iCloud storage to finish a backup, Apple says an alert appears, with on-screen steps to buy more.

How to turn on backup for an Android phone

Based on Google’s instructions (checked October 2026). Menu names vary between phone makers and Android versions; Google’s guide has the latest steps, and Samsung and other makers have their own help pages.

1. Open the Settings app.
2. Go to Google services (on some phones, Google), then All services.
3. Under Backup and restore, tap Backup.
4. Choose what to back up (Photos and videos, Device data, or both) and turn backup on.
5. To back up straight away, tap Back up now.

Google says a backup can take up to 24 hours, and that backups are encrypted with the screen lock only when it’s a PIN, pattern or password. Google’s page also describes the free storage that comes with a Google Account; allowances can change, so the page has the current figure.

How to back up a Windows PC with Windows Backup

Based on Microsoft’s instructions (checked October 2026). Microsoft’s guide has the latest steps.

1. Sign in to Windows with a personal Microsoft account. Microsoft says work and school accounts aren’t supported.
2. Search the Start menu for Windows Backup and open it.
3. Expand Folders and turn on the folders to back up: Desktop, Documents, Pictures, Videos and Music.
4. Expand the other sections (such as Installed apps and Accounts, Wi-Fi networks, and passwords) and turn on the ones wanted.
5. Select Back up.

Microsoft explains that folder backup uses OneDrive and describes the storage included with a free Microsoft account; its page has the current allowance. A cloud copy is one kind of media; the 3-2-1 rule described above refers to copies on at least two. Other Windows settings are covered in Windows computer security basics.

How to back up a Mac with Time Machine

Based on Apple’s instructions (checked October 2026). Apple’s guide has the latest steps for each macOS version.

1. Connect an external storage device. Apple describes using one “with at least twice the storage capacity of your Mac.”
2. Choose Apple menu > System Settings.
3. Click General, then Time Machine.
4. Click Add Backup Disk (or the + button), select the drive, then click Set Up Disk. Turning on Encrypt Backup asks you to set a backup password, which Apple says is needed to restore files.

Apple says Time Machine keeps hourly backups for the past 24 hours, daily backups for the past month and weekly backups for earlier months, and that “The oldest backups are deleted when your backup disk is full.” These steps are for macOS Ventura 13 and later. Other Mac settings are covered in Mac security basics.

How to test that a backup works

A backup that has never been restored is an assumption. Microsoft’s backup guidance describes a simple test (checked October 2026):

1. Create a test file, such as a short document.
2. Let it get backed up along with your important files.
3. Periodically, “once a quarter, or maybe twice a year”, delete the test file from the device.
4. Try to restore it from the backup and check it opens.

The ATO’s backup tips similarly say: “It’s also crucial to test your backups regularly to make sure they work.”

Things to watch for

• Backups that quietly stopped. Full cloud storage, a signed-out account or a drive that hasn’t been plugged in for months can all stop backups. The last-backup date in settings shows whether it’s still running.
• Only one copy, always connected. A drive left plugged in can be encrypted along with the computer, as the ACSC’s case study describes.
• Sync mistaken for backup. If a file is deleted on one device, sync can delete it everywhere.
• Old backups on a sold or recycled device. See how to wipe a device before selling or recycling it.

Common questions

How do I back up my computer and phone?

Each device has a built-in automatic backup: iCloud Backup for iPhone and iPad, Google’s backup for Android, Windows Backup for Windows PCs and Time Machine for Macs. The 3-2-1 rule Microsoft describes adds copies on at least two kinds of media, with one somewhere else, and the ATO describes keeping an offline copy on an external drive that is disconnected when not in use. The steps start at iCloud Backup.

What is the 3-2-1 backup rule?

It’s a rule of thumb for keeping one accident from destroying every copy. Microsoft describes it as having at least 3 copies of important files, on at least 2 kinds of media, with at least 1 of them physically located somewhere else. “Media” means different kinds of storage, such as the device itself, an external drive and a cloud service. The ATO says to keep an offline backup at a different location from the device. More in the 3-2-1 rule of thumb.

How often do I need to back up my files?

Regularly, according to the ACSC’s backups page, which notes “You can set up automatic backups in your system or application settings”. The ATO’s tips say: “The more frequently you backup, the more protected you’ll be.” Automatic backups remove the need to remember, and the last-backup date in settings shows whether they’re still running. Microsoft also describes testing a restore “once a quarter, or maybe twice a year”; see how to test that a backup works.

Is cloud backup enough on its own?

Cloud backup is one copy, on one kind of media. The 3-2-1 rule Microsoft describes calls for copies on at least two kinds of media, with one somewhere else. The ATO’s tips also describe keeping “an offline version of your backup on an external hard drive” and disconnecting it when not in use, which matters because ransomware can encrypt anything a computer is connected to. See why an offline copy matters.

Is syncing my files to the cloud the same as backing them up?

No. Sync copies a change on one device everywhere: Microsoft says changes are “automatically synchronized to the other location”, so a deletion or a ransomware-encrypted file can be synced too. Some services keep earlier versions, such as Microsoft’s OneDrive restore feature for Microsoft 365 subscribers, which covers the last 30 days. Those features are limited in time, which is why the 3-2-1 rule refers to separate copies. See syncing is not the same as backing up.

What do I do if ransomware locks my files?

A backup that wasn’t affected can let files be restored, which is why the ACSC calls backing up “the best way to protect yourself from ransomware and other online threats.” The ACSC’s ransomware page says “Never pay a ransom”, explaining “There is no guarantee you will regain access to your information”. ReportCyber and the ACSC’s 24/7 hotline, 1300 CYBER1 (1300 292 371), are listed under where to get official help, and how ransomware works has more.

Where to get official help

• The ACSC’s backups page links to Apple’s and Microsoft’s own backup instructions.
• If ransomware has struck, the ACSC’s Report and recover page has ReportCyber and the 24/7 hotline, 1300 CYBER1 (1300 292 371). See also how ransomware works.
• For small organisations using Microsoft 365, see what Microsoft 365’s built-in restore features cover.