Three Copies, Two Kinds of Kit, One UK Datacentre: A 2026 Backup Plan That Won't Break the Bank

The 3-2-1 rule is one of those bits of sysadmin folklore that survives because it works: three copies of your data, on two different types of media, with one copy off-site. In 2026 the interesting question is not whether to follow it, but where that off-site copy lives. For a lot of UK households and small businesses, a datacentre in Slough or Leeds is a better answer than a bucket in Virginia.

This is a budget-friendly recipe. It uses restic or Borg, both open source, and assumes you have a home server, a NAS, or even a beefy Raspberry Pi with USB disks. The goal is a setup that is cheap enough to run, encrypted enough to sleep at night, and tested often enough that you trust it.

Start with the boring maths

A 3-2-1 plan is really a risk plan. Your local copy handles quick restores. Your second local copy handles disk failure. The off-site copy handles fire, flood, theft, ransomware, and the sort of accidental rm -rf that makes you go quiet for a minute.

For most home labs, a sensible split is:

• Copy one: the live data on your server or NAS.
• Copy two: a USB hard drive or second NAS, kept in a different room and disconnected when not in use.
• Copy three: an encrypted repository at a UK provider, either object storage or a small VPS with a backup disk.

If you have 1TB of data, expect to pay roughly £5 to £15 a month for the off-site leg at a UK provider. A local USB drive is a one-off £60 to £100. restic and Borg cost nothing. That is a lot less than the cost of rebuilding a photo library or a small business's accounts.

Choosing a UK home for copy three

Data sovereignty is not a magic word. It means you know where the data is, who can touch it, and what legal framework applies. For a UK-focused setup, look for a provider that is UK-registered, stores data in a UK datacentre, and publishes a clear subprocessor list. A GDPR data processing agreement should be available without a treasure hunt. Check whether they are registered with the ICO and whether they offer UK-based support.

Smaller UK providers can be excellent here. Mythic Beasts, Krystal, and Bytemark are long-standing names in the UK hosting scene, and there are plenty of regional VPS outfits. You do not need a hyperscaler. You need a provider that can give you SSH access, object storage, or a backup volume, and that can explain where the disks physically sit.

Avoid any provider that cannot tell you which country your data is in. Avoid one that insists on holding your encryption keys. And avoid a free tier if the price is your data being used for someone else's model training.

Encryption, keys and the ICO

restic and Borg both encrypt client-side. The provider sees ciphertext and metadata, not your files. That is the point. Use a long passphrase stored in a password manager, and keep an emergency copy somewhere offline. If you lose the key, you lose the backup. There is no support desk that can help.

For GDPR purposes, you are probably the data controller; the backup provider is a processor. You need a lawful basis for holding personal data, a retention policy, and a way to restore or delete data when someone asks. The ICO's guidance on backups and storage limitation is worth reading, especially if you keep customer data. A backup is not a licence to keep everything forever. Prune old snapshots on a schedule.

Ransomware and the immutability question

Ransomware does not just encrypt your live files. It looks for mounted backup drives and network shares. That is why copy two should be disconnected or read-only when you are not using it, and why copy three should not be deletable with the same credentials you use for day-to-day work.

Object storage with versioning or object lock is useful. Borg has an append-only mode that can be enforced server-side. restic can write to S3-compatible storage with immutability policies, depending on the provider. None of this replaces a restore test. It just buys you time.

A minimal restic recipe

On the machine that holds your data, initialise a repository at your UK provider:

restic init --repo sftp:backup@uk-vps:/srv/restic

Back up a directory:

restic backup --repo sftp:backup@uk-vps:/srv/restic /home/you/photos

Check the repository:

restic check --repo sftp:backup@uk-vps:/srv/restic

List snapshots:

restic snapshots --repo sftp:backup@uk-vps:/srv/restic

Restore to a temporary directory:

restic restore latest --repo sftp:backup@uk-vps:/srv/restic --target /tmp/restore-test

Borg is just as happy: borg init --encryption=repokey, borg create, borg check. Pick one and learn it. The tool matters less than the routine.

The restore drill that proves it works

A backup you have not restored is a rumour. Once a month, pick a random file or folder from the off-site repository and restore it to a scratch directory. Once a quarter, do a bigger test: restore a whole project or a database dump onto a spare disk. Time it. Write down how long it took.

Your target recovery point objective is how much data you can afford to lose. Your recovery time objective is how long you can afford to be down. For a home lab, losing a day of photos might be fine. For a small business, losing a day of invoices is not. Adjust the schedule accordingly.

Keep the restore notes somewhere outside the backup. There is no point having a beautiful runbook stored only in the system that just died.

The budget reality

You can build this for less than a streaming subscription. A UK VPS with 500GB to 1TB of backup storage is often £5 to £20 a month. Object storage is priced per gigabyte, so watch egress fees and minimum retention. A local USB drive is cheap. The expensive part is your time, and the restore drill is where that time pays off.

Data sovereignty on a budget is not about building a fortress. It is about knowing where your copies are, encrypting them before they leave the house, and proving you can get them back. Do that, and you are ahead of most people who call themselves prepared.