What is the 3-2-1 backup rule?

If you have ever asked someone who looks after servers how to back up your data, there is a good chance they answered with three numbers: 3-2-1. It is the most widely repeated rule in data protection, and it has lasted because it is short enough to remember and strict enough to survive most of the ways data actually gets lost.

Where the rule comes from

The 3-2-1 rule is usually credited to photographer Peter Krogh, who described it in his book on digital asset management for photographers in the mid-2000s. Photographers were among the first ordinary computer users to face the problem at scale: thousands of irreplaceable files, large enough that they did not fit on one disk, and no second chance if a shoot was lost.

The idea was not new to IT teams, but Krogh’s phrasing stuck, and it has since been adopted well beyond photography by backup vendors, government advisories and system administrators everywhere.

The three numbers

3 — keep three copies of your data

Your original counts as one. You need two more. Why three and not two? Because when one copy fails, you are down to a single copy while you recover, and that is exactly the moment a second failure hurts most. A third copy gives you a margin during the recovery itself.

2 — on two different kinds of storage

The copies should not all live on the same type of medium, or in the same system. Two folders on the same laptop are one copy, not two. Two external drives bought on the same day from the same batch can fail in similar ways. “Different kinds” today usually means a mix such as:

• the device you work on (phone, laptop, server disk)
• an external drive or NAS at home or in the office
• cloud object storage run by a provider

The point is to avoid a single fault, firmware bug or software mistake affecting every copy at once.

1 — with one copy off-site

At least one copy has to be physically somewhere else. Fire, flood, theft and a burst pipe do not care how many drives you have on the same shelf. In India, monsoon flooding and power surges are not hypothetical; a building-level event can take out every device in the flat or office.

Three copies, on two kinds of storage, with one far away. If any single event can destroy all your copies, you do not yet have a backup plan.

What the rule looks like in practice

For a household, a reasonable 3-2-1 setup might be:

1. Photos and documents on your phone and laptop (copy 1).
2. An automatic backup to a cloud service in your home region (copy 2).
3. A further copy in a different region or with a different provider, or an external drive kept at a relative’s home and refreshed regularly (copy 3).

For a small business, it might be:

1. The production database and file server (copy 1).
2. Nightly backups to a local NAS for fast restores (copy 2).
3. The same backups pushed to cloud object storage in another city or country (copy 3).

Common mistakes

Counting sync as a backup

Google Drive, iCloud Drive, OneDrive and Dropbox are designed to keep files the same everywhere. If you delete a file or ransomware encrypts it, that change is copied too. Sync is useful, but it is not one of your three copies unless it keeps versions you can roll back to, for long enough to notice a problem.

Keeping every copy in the same account

Three copies inside one cloud account share one password, one billing relationship and one set of terms of service. If the account is locked, compromised or closed, all three go together.

Setting it up once and never checking

Backups fail quietly. A drive fills up, a password changes, an app gets logged out after an update. The 3-2-1 rule says nothing about verification, which is why many people now extend it (more on that in a later post on 3-2-1-1-0).

Forgetting what is not on the phone

People often back up photos carefully and forget email, scanned documents, SMS, or the accounting software on the office PC. Make a list of what you would actually miss, not just what is easy to back up.

Off-site, but only just

A drive in the car or in the office next door is better than nothing, but it may not survive a city-wide flood or a regional cloud outage. “Off-site” works best when it is genuinely independent of the first location.

A quick self-check

Ask yourself these questions about the data you care about most:

• How many separate copies exist right now? Count only ones you could restore from.
• Are any two of them on the same physical device or in the same account?
• Is at least one copy in a different building, city or country?
• When did you last restore a file from each copy?
• If your phone was stolen today, what would be gone for good?

If any answer makes you uncomfortable, that is the part of your setup to fix first.

Closing note

triplicate is being built around this rule: your device holds copy 1, we keep copy 2 in your home region and copy 3 on another continent with a different storage provider. We are not live yet. You can read more on our 3-2-1 page or join the waitlist.