The short answer is no, Google does not back up your data in the way most business owners assume. If you delete a file today and realize you needed it six months from now, Google will not be able to get it back for you. If a disgruntled employee wipes their inbox before leaving, or a ransomware attack encrypts your shared drives, Google’s job is to sync those changes across all your devices, not to offer you an 'undo' button.
There is a fundamental misunderstanding between 'availability' and 'backup'. Google is excellent at availability. They ensure that Gmail and Drive are accessible 99.9% of the time. They mirror your data across multiple data centres so that if one server fails, another takes over. But mirroring a mistake is still a mistake. If data is deleted or corrupted, Google faithfully mirrors that deletion or corruption across their entire infrastructure.
The difference between service availability and data recovery
When you sign up for Google Workspace, you enter into a 'Shared Responsibility Model'. Google takes responsibility for the physical security of their data centres, the power to the servers, and the software that runs the applications. You take responsibility for the data you put into those applications.
If Google’s data centre in Dublin is hit by a power outage, they have systems to keep your business running. That is availability. If a member of your team accidentally deletes a folder of client contracts and then empties the 'Trash', that is a data loss event. Google considers that a legitimate user action. They have no way of knowing it was a mistake, so they carry out the instruction.
In a standard Google Workspace setup, once a file is removed from the Trash (which happens automatically after 30 days), it is gone. There is a small window of about 25 days where an administrator can attempt to recover deleted data, but this is limited to specific types of data and is not a reliable disaster recovery strategy.
Why Google Vault is for lawyers, not for disaster recovery
We often speak with business owners who believe they are protected because they have Google Vault. Vault is an eDiscovery and archiving tool included in higher-tier licences like Business Plus and Enterprise. It is designed to preserve data for legal or compliance reasons.
Vault works by 'holding' data. If you set a retention policy, Vault will keep a copy of every email sent or received, even if the user deletes it from their inbox. However, Vault is not a backup tool for three specific reasons:
- No easy restore: You cannot simply click a button in Vault to put a folder back exactly where it was in a user’s Drive with all the permissions intact. You have to export the data and then manually re-upload it.
- It is not point-in-time: A true backup allows you to say, 'Take my entire Workspace back to exactly how it looked at 10:14 AM last Tuesday.' Vault cannot do this.
- It is tied to the account: If the Google Workspace account itself is compromised or deleted, your Vault data is at risk. A proper backup should live outside the ecosystem it is protecting.
How data loss actually happens in UK SMEs
The most common cause of data loss is not a sophisticated hack. It is simple human error. A pattern we see on most tenants we take on is that users treat the 'Trash' or 'Bin' as a temporary filing cabinet. They delete things to clear their view, assuming they can get them back later.
Another common scenario involves staff offboarding. When an employee leaves, many businesses delete their Google Workspace user account to save on monthly licence costs. Unless that data was manually migrated to a Shared Drive or another user, it is permanently deleted along with the account. We have seen businesses lose years of project history because they deleted an account to save £10 a month without a secondary backup in place.
Ransomware is the third major risk. If a user has 'Google Drive for Desktop' installed, the files on their computer are synced to the cloud. If ransomware encrypts the files on that laptop, the encrypted versions are immediately synced to Google Drive, overwriting the healthy versions. Without a third-party Google Workspace backup, you are left trying to manually revert every single file to a previous version, which is impossible at scale.
What a third-party backup actually does
A dedicated backup service for Google Workspace, like the ones we deploy for our clients, acts as an insurance policy. It connects to your Google account via an API (Application Programming Interface, a way for software to talk to other software) and takes a snapshot of your data several times a day.
This data is stored on a completely different cloud platform, usually encrypted and 'immutable' (meaning it cannot be changed or deleted by ransomware). If you lose data in Google, we can browse the backup, find the exact folder or email from a specific date, and restore it directly back into the live account in seconds.
This covers Gmail, Google Drive, Shared Drives, Contacts, and Calendars. It ensures that even if a user is deleted from Google, their data remains searchable and restorable in the backup archive for as long as you choose to keep it.
The cost of doing nothing
To understand the value of backup, you have to model the cost of a recovery effort without one. Take a hypothetical 20-person professional services firm in the UK. If a folder containing 5,000 files is accidentally deleted and the 30-day window has passed, the cost is not just the lost data, but the time spent trying to recreate it.
- Staff downtime: 20 staff unable to access key files for 2 days. At a modest average cost of £30 per hour (including NI and pension), that is £9,600 in lost productivity.
- Management time: Senior staff spending 10 hours coordinating a response and talking to clients: £500.
- Re-creation cost: If 5% of those files need to be manually recreated from old emails or paper records, you might be looking at 100 hours of work: £3,000.
Total estimated cost: £13,100.
A professional backup service usually costs around £3 per user, per month. For that same 20-person firm, that is £720 a year. It would take 18 years of backup subscriptions to equal the cost of just one moderate data loss event.
Three mistakes we see repeatedly
- Trusting the 'Bin': Assuming that because a file is in the Bin, it is safe. Google clears the Bin every 30 days. It is a temporary holding area, not a storage solution.
- Relying on Google Takeout: Google Takeout is a tool for exporting your data, but it is a manual process. It is not a backup because it is not automated, it is not regular, and it is very difficult to restore from.
- Manual downloads: We see businesses where a staff member is tasked with downloading important folders to an external hard drive once a month. This is prone to failure, doesn't cover email, and the hard drive itself is a single point of failure.
Compliance and Cyber Essentials
For UK businesses, the regulatory landscape is also a factor. The Information Commissioner’s Office (ICO) expects businesses to have 'appropriate technical and organisational measures' to ensure the availability of personal data. If you lose client data because you didn't have a backup, you may find yourself in a difficult conversation regarding GDPR compliance.
Furthermore, Cyber Essentials certification requires that you have a backup strategy. While the basic certification doesn't always mandate third-party cloud backup, the 'Plus' audit and general best practice recommendations from the NCSC (National Cyber Security Centre) strongly advise that cloud data is backed up independently of the service provider.
How Black Sheep Support helps
We manage Google Workspace for businesses that cannot afford to lose their data. We don't just 'turn on' the backup; we monitor it. Every day, our systems check that the backups for our clients have run successfully. If a backup fails because of a Google API change or a permissions issue, our helpdesk is alerted and we fix it during office hours.
We also handle the offboarding process. When a member of your staff leaves, we ensure their data is safely archived in the backup before the Google licence is cancelled, saving you money without risking your intellectual property. We also handle hardware, broadband, mobile and networking, making sure the entire chain of your IT is secure.
If you are unsure whether your Google data is actually protected
and we'll help you map out exactly where your risks are.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture: 30 to 60 minutes with one of our engineers on a Teams call, or 15 to 20 minutes on your own, no commitment.
FAQ
Does Google Drive keep versions of my files? Yes, Google Drive keeps a version history for Google Docs, Sheets, and Slides. For non-Google files (like PDFs or Word docs), it keeps versions for 30 days or up to 100 versions. However, this is for individual file recovery, not for recovering an entire folder structure after a bulk deletion or ransomware event.
If I have Google Vault, do I still need a backup? Yes. Vault is an archive for legal discovery, not a recovery tool. Restoring a deleted user's entire Drive and Gmail from Vault is a slow, manual, and painful process that often loses the original folder structure and permissions. Backup is designed for speed and business continuity.
Can I just sync my Google Drive to a local NAS or server? While possible, it is not a true backup. If your Google Drive is hit by ransomware, the sync will often push the encrypted files to your NAS, overwriting the good ones. A proper backup should be 'air-gapped' or immutable, so the data cannot be changed once it is written.
What happens to my data if I stop paying for Google Workspace? Google will eventually delete your data if you stop paying for your subscription. There is usually a short grace period, but it is not a permanent storage solution. A third-party backup allows you to keep your data even if you decide to close the Google account or migrate elsewhere.
Want this handled for you? See Microsoft 365 support.
Based in Brighton or Hove? We are too: see IT support in Brighton.
