Start backing up photos and videos regularly: your memories in more than one place

Your phone has quietly become the family album, the document archive and the diary of the last few years. It holds photos of the children when they were small, videos from birthday parties, a scan of your passport, medical letters, the tenancy agreement you photographed in a hurry. Everything is close at hand and always with you, so it feels like the safest place in the world.

And yet a phone can fall into water, be left on a train, or refuse to switch on after an update. A computer can fail without warning, and a finger can tap “delete” on the wrong album. If those files exist in only one place, any incident — even the most ordinary one — becomes a permanent loss. You can buy another device; you cannot buy back your memories.

This recommendation — R19 of the Cyber Welfare Framework — is there to make sure that an incident stays an inconvenience and does not turn into a digital bereavement. Backing up photos and videos on a regular basis does not require technical skills. It requires a decision, a second place to keep the copies, and a habit that, once set up, largely looks after itself.

What this recommendation says

Recommendation R19 states that important personal photos, videos and documents should be copied regularly to at least one place other than the device they live on, automatically, securely and in a way you have checked.

A backup is a safety copy: a separate version of your files that remains available even if the original is lost, broken or changed. To really work, it needs five qualities:

• regular — it is updated on a schedule, not “whenever I remember”;
• separate — it sits on another device or in another place, not on the same phone or computer;
• automatic — it starts on its own, so it does not depend on anyone’s memory;
• protected — it is guarded by a strong password and, wherever possible, encrypted;
• checked — every so often, someone makes sure the files can actually be recovered.

What it is not. It is not simple syncing, the mechanism that keeps two places identical: if you delete a photo from your phone, syncing deletes it from the cloud as well. Syncing only helps as a backup if the service keeps a bin or a history of earlier versions. Nor is it moving your photos to a drive and then deleting them from the phone: in that case there is still only one copy — it has simply changed address. And it is not a USB stick forgotten in a drawer, last updated three years ago.

Where it applies. To family photos and videos, scanned documents (identity, health, tax, home, work), messages and notes that matter, study work and personal projects. It covers phones, computers and tablets, and it also applies to the devices of the people you look after: elderly parents, children, your partner. Apps, on the other hand, do not need saving: you can always reinstall them from the official app stores.

Why it matters

Most data loss does not come from a sophisticated attack. It comes from everyday life:

• a hardware fault — the storage inside devices has a limited lifespan and sometimes gives up without warning;
• loss or theft — the phone disappears, and with it everything that was stored only there;
• physical damage — a drop, a spilt glass, a thunderstorm;
• human error — an album deleted to free up space, a folder overwritten by mistake;
• an update or repair gone wrong — rare, but possible;
• ransomware — malicious software that encrypts your files, making them unreadable, and demands a ransom to give them back. How it works, and why it goes after personal files in particular, is explained in our post on ransomware and personal files.

In all of these cases, without a copy, recovery is often impossible. Professional data recovery services do exist, but they are expensive and offer no guarantees. With a backup, the incident shrinks to a procedure: new device, sign in to the backup, restore.

The consequences of a loss show up on four fronts:

• irreplaceable memories — nobody can retake the photos of a first birthday or record a grandparent’s voice again;
• documents to rebuild — requests, offices and waiting times to get back papers you already had;
• time and stress — days spent hunting for copies scattered across chats, emails and relatives;
• depending on others — if ransomware locks your files and you have no copy, the choice is no longer yours.

There is also a less visible side: a poorly protected backup can expose the very data you want to keep safe. An unencrypted drive lost on a train, or a cloud account with a weak password, keeps your photos available to people who should never see them. That is why R19 asks for copies that are regular and protected.

A concrete example

Lucy has two children and a phone holding six years of photos: first steps, school plays, holidays, the baby scan pictures photographed from the screen. A few years ago she switched on automatic saving to the cloud and has not thought about it since.

One summer afternoon her phone slips into the lake. It never switches on again. Lucy is calm: “It’s all in the cloud anyway.” But when she signs in from her computer, she discovers that saving stopped eight months earlier. The free storage had filled up and the service had quietly stopped copying new photos. There had been a notification, but it got lost among all the others.

The photos up to the previous autumn are all there. The ones from the last few months, including the children’s end-of-year school party, Lucy only partly recovers, from her chats with their grandmother and the other parents.

It is not a tragedy, and that is exactly the point: without that backup, imperfect as it was, she would have lost six years. With a checked backup, she would have lost nothing.

Since that day Lucy has done three things. She freed up space in the cloud and chose a suitable plan. She bought an external drive, copies everything onto it on the first Saturday of every month and then keeps it at her sister’s house. And every three months she opens the backup and tries downloading a random photo. It costs her ten minutes now and then, and she now knows that her memories exist in more than one place.

When to apply it

Backups always matter, but some moments are particularly well suited to setting them up or checking them.

• When you set up a new device. This is the easiest moment: backup settings can be switched on along with everything else, in a few minutes.
• After events that produce lots of photos. A trip, a party, a birth, a house move: these are the days when the files we care about most pile up.
• Before a major update or a repair. Updates are a valuable protection, as explained in the recommendation on keeping your software up to date; a recent backup also takes the worry out of the rare case when something goes wrong.
• Before selling, giving away or replacing a device. Before you wipe it, make sure everything is already safe somewhere else.
• When you photograph or scan an important document. A document that exists only in your phone’s gallery is one step away from being lost.
• When your phone says it is running out of space. Before deleting anything to make room, check that it has already been copied.
• For your family’s devices. Parents and grandparents are often the ones holding the only copy of photos the whole family cares about.

How to apply it

You do not need to do it all in one evening. What you need is a clear sequence.

1. Decide what to protect. Photos and videos, scanned documents, folders of study or personal work, and any important chats: many messaging apps have a separate backup that needs switching on on its own. Anything you can download again, such as apps, is not needed.
2. Choose at least one second place. This can be a cloud service — storage space on servers you reach over the internet — or an external drive. Ideally, use both: the 3-2-1 backup rule — three copies, on two different types of storage, one of them away from home — is the simplest way to organise yourself. The pros and cons of each option are covered in our post on cloud or external drive backup.
3. Automate it. Turn on automatic backup in the settings of your phone’s and computer’s operating system, for example overnight while charging and on Wi-Fi. For the external drive, set a recurring reminder in your calendar: the first Saturday of the month, or any date you find easy to remember.
4. Choose reliable, privacy-respecting services. Check who runs the service, where it keeps your data and whether it offers encryption — turning files into a format that only someone with the right key can read. Where it is available, prefer “client-side” or “end-to-end” encryption, where only you hold the key. Also check that there is a bin and a version history, which help against mistaken deletions.
5. Protect access to your backups. Your cloud account deserves a long, unique password and multi-factor authentication (a second check on top of the password, such as a code on your phone). The external drive should be encrypted, as suggested in the recommendation on encrypting your personal devices. Keep the backup password somewhere safe, such as a password manager: the recommendation on storing passwords safely explains how. A forgotten password is as bad as a lost backup.
6. Unplug the drive and keep it elsewhere. Once the copy is done, disconnect the drive: if it stays plugged in all the time, a power surge or ransomware can reach it along with the computer. If you can, keep it somewhere other than your home, for instance with a relative.
7. Check that restoring works. Every so often, look at the date of the last backup and, at least every three months, try recovering a random photo and a document. A backup only really exists once you know it can be opened. The signs your backup is not working help you notice problems in time.

Common mistakes to avoid

• Confusing syncing with backing up. If the cloud simply mirrors your phone, a deletion or a damaged file spreads everywhere.
• Moving instead of copying. Transferring photos to a drive and deleting them from the phone still leaves a single copy, just in a different place.
• Ignoring “storage full” warnings. When space runs out, many services simply stop saving, without insisting.
• Leaving the drive permanently connected. It is convenient, but it exposes the copy to the same risks as the original.
• Never testing a restore. Many people find out their backup was incomplete on the very day they need it.
• Unprotected backups. An unencrypted USB stick with scans of your documents, lost or lent to someone, is a privacy problem before it is even a security one.
• Trusting an unknown service just because it is free. Whoever looks after your memories deserves the same trust as whoever looks after your savings: find out who they are and how they protect your data.

How this connects to the Cyber Welfare Framework

R19 turns digital resilience from an abstract idea into a concrete habit: accepting that incidents happen, and making sure they cannot take away what matters.

Digital maturity levels.

• FL1 — Basic. Your photos and documents exist only on your phone or computer. It is the most common starting point, not a fault.
• FL2 — Beginner. Automatic backup to at least one second place is switched on, and you know where your copies are.
• FL3 — Autonomous. You have two copies on different types of storage, protected by passwords and encryption, and you regularly check that they are updating.
• FL4 — Skilled. You follow the 3-2-1 rule and test restores regularly, fixing straight away anything that does not work.
• FL5 — Expert-Guide. You help other people — in your family, among friends, in your community — keep their memories safe.

R19 is the key step from FL1 to FL2, and it remains an active habit at every level after that.

How to check you are applying it properly

Three questions, to be answered honestly.

1. If I lost my phone today, which photos and documents could I never get back?
2. Do I know when my last backup was made, without having to guess?
3. In the last three months, have I tried opening at least one file from my backup?

Quick checklist

• ☐ The photos and videos on my phone are copied automatically to a second place
• ☐ My important scanned documents are included in the backup
• ☐ At least one copy is kept away from home or on storage separate from the device
• ☐ My backup account has a unique password and multi-factor authentication
• ☐ My external drive is encrypted and stays unplugged when not in use
• ☐ I have recently tried restoring a file, and it worked

If a box stays empty, you already have your next step. If you would like a broader measure of how prepared you are, you can take the digital resilience self-assessment.

In short

Personal photos, videos and documents are among the most precious things we keep, and they often exist in only one place. Hardware faults, lost phones, mistakes and ransomware are common events: a backup is what makes them reversible.

The solution is simple to organise: regular copies in at least one place other than the device, automatic backup, reliable and encrypted services, protected access, drives that are unplugged and kept elsewhere, and a test restore every so often.

This is not about living in fear of losing everything. It is about enjoying your memories with the peace of mind of someone who knows there is always a second copy.

Something to think about. Of all the photos you have taken this year, how many exist today in only one place?

Explore this recommendation

This recommendation is the pivot of a content unit. Each post looks at a different aspect.

• Losing personal files — what gets hit, in terms of the confidentiality, integrity and availability of your files
• Lost phone without a backup — the concrete effects on the operational, financial, legal, reputational and personal levels
• The 3-2-1 backup rule — the mitigations, from prevention to recovery
• Signs your backup is not working — the indicators to check and what they mean
• Cloud or external drive backup — the technologies available, their advantages and limits
• Ransomware and personal files — the attacks that hold photos and documents hostage

Related resources

Short reads from the Resources section, for anyone who wants to focus on a single aspect:

• Data Backup: The Only Protection That Works Afterwards
• Data Encryption: Already On, and Worth Understanding

Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.