Disaster recovery planning for small businesses in South Africa

The server stops. Nobody in the office can access their files, their email, or the accounts system. Someone says “we have a backup” but nobody knows where it is, when it last ran, or whether it actually works.

This scenario is not unusual. We have seen it more than once in Cape Town businesses, and the conversation that follows is always expensive. Emergency recovery rates, lost working hours, and sometimes data that is simply gone.

Disaster recovery planning sounds like something only big companies need. It is not. If your business has data it cannot afford to lose – client records, financials, emails, project files – you need a plan for what happens when something goes wrong. The good news is that for a small business, the plan does not need to be complicated.

What “disaster” actually means for a small business

When people hear “disaster recovery”, they think of fires, floods, and ransomware attacks. Those things do happen. But the disasters we see most often in small businesses are far more ordinary:

• A server hard drive fails. Hardware has a lifespan. Drives fail without warning. If your data is only on that drive, it is gone.
• Load shedding corrupts a database. Power cuts mid-transaction can leave databases in an inconsistent state. When the power comes back, the software will not start properly.
• Someone deletes the wrong files. Accidental deletion is more common than malware. A shared drive with no versioning means those files are gone unless there is a backup.
• A laptop gets stolen. Laptops contain local files, browser-saved passwords, and often cached copies of cloud data. If the device is not encrypted and there is no backup, you have lost both the data and potentially compromised client information.
• The “IT person” leaves. In many small businesses, one person knows all the passwords, where the backups are stored, and how things are configured. When they leave, that knowledge walks out the door.

None of these are dramatic. All of them can stop a business for days.

The three things most small businesses get wrong about backup

1. Thinking syncing is the same as backup

If your files are on OneDrive, Google Drive, or Dropbox, they are synced across devices. That is not backup. If someone deletes a file, the deletion syncs everywhere. If ransomware encrypts your files, the encryption syncs. If your account is compromised, the attacker has access to everything that syncs.

Backup means a separate, protected copy of your data that cannot be affected by what happens to the original. Syncing keeps your files accessible. Backup keeps them recoverable.

2. Having a backup that nobody monitors

A backup that has not been checked is just a hope. We have seen backup drives still plugged into servers that stopped working months ago. We have seen cloud backup subscriptions that expired without anyone noticing. We have seen backup jobs that have been failing silently for weeks, sending error emails to an inbox nobody reads.

A backup only counts if someone is checking that it completes, that the data is intact, and that it can actually be restored.

3. Never testing a restore

This is the most common mistake and the most dangerous one. You discover your backup does not work at the worst possible moment – when you need it. A backup that has never been restored is an assumption, not a plan.

Testing a restore means picking a file (or a whole system image) and recovering it to confirm the process works, the data is complete, and you know how long it takes. If you have never tested your restore, you do not have disaster recovery. You have disaster hope.

What a practical disaster recovery plan looks like

For a small business, disaster recovery does not need a 50-page document. It needs answers to five questions:

1. What data matters most?

Not everything is equally important. Your accounting database, client records, and email are probably critical. Your desktop wallpaper collection is not. Identify the data that would stop your business if it disappeared, and make sure that data is backed up first.

For most small businesses, the list is:

• Server data (files, databases, applications)
• Microsoft 365 data (email, OneDrive, SharePoint, Teams)
• Workstation files that are not stored centrally
• Any on-premises databases (Pastel, Sage, custom applications)

2. How often should it be backed up?

This depends on how much work you can afford to lose. If your database changes every hour, a daily backup means you could lose up to a day’s work. If that is unacceptable, you need more frequent backups.

For most small businesses, daily backups are the minimum. Businesses with high-transaction environments (accounting, logistics, e-commerce) should consider multiple backups per day.

3. Where should backups be stored?

At minimum, off-site. A backup on the same server as your data is not protection – if the server fails, you lose both. A backup on an external drive sitting next to the server is not much better – a theft, fire, or power surge takes both.

Off-site backup (to a secure data centre) protects against physical events. A local copy in addition to off-site gives you faster restores when you need to get back to work quickly.

4. How long would it take to recover?

This is the question most people forget to ask. Even with a perfect backup, restoring a full server takes time. Hours, sometimes a full day. Can your business operate during that time?

Knowing your recovery time helps you plan. Maybe you need email continuity so staff can still communicate during a server outage. Maybe you need a temporary way to access critical files while the main system is being restored.

5. Who is responsible?

Someone needs to own this. Not “the team” or “IT” as a vague category, but a specific person (or service provider) who monitors backups, runs test restores, and knows the recovery process. If nobody is responsible, it will not get done.

The load shedding factor

South Africa adds a layer of complexity that disaster recovery guides written for other countries do not cover.

Load shedding is not a hypothetical risk. It is a regular event that causes real damage to IT equipment:

• Database corruption: Power cuts mid-write leave databases in an inconsistent state. We have seen accounting systems and email databases that would not start after an unplanned shutdown.
• Hardware damage: Repeated power cycling wears out hard drives and power supplies. Surge damage when power returns can kill equipment instantly.
• Backup interruption: If a backup is running when the power goes off, that backup may be incomplete or corrupted.

A UPS (uninterruptible power supply) gives your server and network equipment enough time to shut down safely during a power cut. It is not optional for any business running a server in South Africa. But a UPS is not a substitute for backup – it protects against the immediate power event, not against the hardware failure that happens six months later because of accumulated power cycling damage.

Off-site backup is the real protection. Your data is in a secure data centre that has its own power infrastructure, not on equipment that goes through load shedding every week.

Start with what you have

You do not need to overhaul everything at once. If you currently have no disaster recovery plan at all, start here:

1. Identify your critical data. Write down the five to ten things your business cannot function without. Where are they stored right now?
2. Check your current backups. Do you have any? When did they last run? Has anyone ever tested a restore? If you cannot answer these questions, you have a gap.
3. Get Microsoft 365 backup in place. Most businesses assume Microsoft backs up their data. It does not. Microsoft provides availability (keeping the service running) but not backup. If you delete an email or a OneDrive file beyond the retention window, Microsoft cannot get it back. A third-party M365 backup costs relatively little and protects your email and cloud files.
4. Talk to your IT provider. If you have one, ask them: what is backed up, how often, where, and when was the last restore test? If they cannot answer clearly, that is a problem.

These four steps take less than an afternoon and give you a real picture of where your business stands.

Not sure if your data is properly protected?

We can review your current backup setup and tell you where the gaps are. No sales pitch, just a clear assessment of what is covered, what is not, and what it would take to close the gaps.

Talk to us about your backup

Or get in touch directly:

Call: 087 820 5005 WhatsApp: 081 526 1626

Want to see what proper data protection looks like? See our business continuity solutions for backup tiers, M365 protection, and recovery testing.

Related reading

• Business backup: what it actually means and what you need
• Data breach response: what to do in the first 72 hours
• Server down? What to do while you wait for IT
• Is your business IT ready for load shedding?