Guides

Small Business · Security

Is Your Business Data Safe? A 5-Minute Self-Audit

Last year an accountant in Derby rang me after her laptop was stolen from her car. Six years of client tax returns, payroll records, and HMRC correspondence — all on a machine with no password, no encryption, and no backup. The thief had complete access to dozens of people's financial records. She'd never thought about data security because nobody had ever told her to. It doesn't need to happen to you.

Published 27 June 2026 · 8 min read

Why this matters more than you think

I've been doing IT support for small businesses across Nottingham and Derby for over a decade. In that time I've seen a wedding photographer lose an entire year's work to ransomware, a solicitor's firm get locked out of their email for a week because someone reused a password, and a café owner who'd been sharing his accounting login with three staff members — including one who'd left six months earlier and still had access.

None of these people were careless. They were busy running businesses. Data security felt like something for big companies with IT departments, not for a one-person operation working from a spare bedroom. But the reality is that small businesses are targeted because they're easier — fewer defences, less awareness, and often more valuable data than people realise.

The good news: protecting your business data doesn't require an expensive security consultant or a degree in computer science. Most of the highest-impact fixes are free and take minutes. This guide walks you through the five questions I ask every new client during their first visit — and the practical steps that follow.

Question 1 — Where is my data right now?

This sounds obvious, but most business owners I meet can't answer it completely. Your data isn't just "on the computer." It's scattered across a dozen places you've probably forgotten about.

Grab a piece of paper and list every location where your business information lives. Be honest. Most people I do this exercise with find at least five places they hadn't considered:

  • Your laptop or desktop computer — documents, spreadsheets, accounting software files, email archives stored locally
  • Cloud storage — OneDrive, Google Drive, Dropbox, iCloud. Do you know what's in each one?
  • Your phone — contact lists, WhatsApp conversations with clients, photos of receipts and invoices
  • Email inbox — years of attachments, client correspondence, booking confirmations, payment receipts
  • USB sticks and external drives — that one in the drawer, the one you gave to your accountant, the one your old employee handed back (maybe)
  • Accounting software — QuickBooks Online, Xero, FreeAgent. Your books live there, but do you have a local copy?
  • Your website — customer orders, contact form submissions, product listings, blog content
  • Social media accounts — your business Facebook page, Instagram content, LinkedIn connections. If you lost access tomorrow, could you get them back?
  • Paper records — signed contracts, delivery notes, warranty certificates sitting in a filing cabinet

Once you've listed everything, put a tick next to each item where you're confident you could recover it within 24 hours if it vanished tonight. The ones without a tick are your vulnerabilities. That's your starting point.

Question 2 — Who can access my data?

Access control is where small businesses consistently fall down. Not through malice — through convenience. It's easier to share a password than to set up proper user accounts. It's easier to leave an ex-employee on the shared drive than to go through the admin panel and remove them.

Here's the checklist I run through with clients:

  • Shared passwords. Does everyone in the business use the same login for your accounting software? Your email? Your cloud storage? If someone leaves, do you change them?
  • Ex-employees. Go through every online service you use — your website admin, social media accounts, Google Business Profile, domain registrar, cloud storage, email admin panel — and check who has access. I once found a restaurant's ex-manager still had full admin on their Facebook page two years after leaving.
  • Family members. Does your partner or a family member have the password to your business laptop? Your email? Are they using your machine for personal browsing — downloading things, clicking links — on the same device that holds your client data?
  • Third parties. Your bookkeeper, your web developer, your social media person. They need access to specific things — but do they have more access than they need? Can you revoke it quickly if the relationship ends?
  • Physical access. If someone walks into your office or shop right now, can they sit down at an unlocked computer? Is your laptop left on the passenger seat of your car between client visits?

The fix for most of this is a password manager (I recommend Bitwarden — it's free) and ten minutes of going through your accounts to remove old users. I'll cover the quick-win fixes at the end of this guide.

Question 3 — Is it backed up?

I've written a whole separate guide about backups, so I'll keep this section focused on the safety angle. The quick version: if your answer to "is it backed up?" is "I think so" or "it's in the cloud," you probably have a gap.

Here's the 3-2-1 rule in one paragraph: keep three copies of your important data, on two different types of storage, with one stored offsite. If your only copy is on your laptop and you've never backed it up, you're at zero. If your files are in OneDrive, that's one copy — but OneDrive syncs deletions and ransomware encryption instantly, so it's not a true backup. You need something separate that keeps old versions.

The most common misconception I encounter: cloud sync is not backup. OneDrive, Google Drive, and Dropbox are synchronisation services. If you accidentally delete a folder, it disappears from the cloud too. If ransomware encrypts your files, those encrypted versions sync to the cloud immediately. A proper backup service — like Backblaze (£6/month per computer) — keeps multiple versions going back weeks or months. You can roll back to yesterday, last week, or last month.

Ask yourself: if your laptop died right now and you bought a new one this afternoon, how long would it take to get back to working normally? If the answer is "days" or "I honestly don't know," your backup situation needs attention.

Question 4 — Do I have two-factor authentication turned on?

Two-factor authentication — 2FA for short — means you need two things to log in: something you know (your password) and something you have (usually your phone). It's the single most effective defence against someone stealing your password and taking over your accounts. And it's free.

Here are the accounts where 2FA is non-negotiable for a small business:

  1. Email. This is the big one. If someone gets into your email, they can reset the password on almost every other account you own. Your email is the master key. Microsoft 365, Google Workspace, and even free Gmail all support 2FA. Turn it on today if you haven't already.
  2. Banking. Most business bank accounts require 2FA by default now, but check. If yours doesn't offer it, ask them why.
  3. Accounting software. QuickBooks, Xero, Sage, FreeAgent — all support 2FA. Your books contain every client name, every invoice, and your bank transaction history.
  4. Domain registrar. If someone takes over your domain (e.g., vengera.co.uk), they can redirect your website, hijack your email, and hold your online identity hostage. This happens more often than you'd think. Your domain is the foundation of your online presence — lock it down.
  5. Website admin. WordPress, Shopify, Squarespace — whatever runs your site. A compromised website can distribute malware, steal customer data, and get you blacklisted by Google.
  6. Cloud storage. OneDrive, Google Drive, Dropbox. All your business files, accessible to anyone with your password — unless 2FA stops them.

Use an authenticator app (Microsoft Authenticator, Google Authenticator, or Authy) rather than SMS text messages when possible. SMS-based 2FA is better than nothing, but SIM-swap attacks — where someone convinces your mobile provider to transfer your number to their phone — make it less secure than an authenticator app.

Question 5 — What happens if my laptop is stolen today?

This is the question that makes people uncomfortable, and that's exactly why it matters. Laptop theft is common — from cars, from cafés, from offices during a break-in. If someone took your computer right now, what would they find?

Three things to think about:

  • Can they read your files? If your laptop doesn't have a password (or the password is written on a sticky note attached to the screen — I've seen it), everything on it is theirs. All your documents, client records, saved passwords in your browser, email accounts that stay logged in. Even if you have a password, a standard Windows login is easy to bypass if the drive isn't encrypted. Someone can remove the hard drive, plug it into another computer, and read everything.
  • Is your drive encrypted? Encryption scrambles your data so it's unreadable without your password. Windows has BitLocker built into Windows Pro (right-click your C: drive, select "Turn on BitLocker"). It takes ten minutes to set up and it's free. If your laptop is stolen, the thief gets a paperweight — not your entire business. Macs have FileVault, which works the same way. If you do one thing from this entire guide, encrypt your drive.
  • Can you remotely wipe it? If your laptop is signed into a Microsoft account with "Find My Device" enabled, you can remotely lock it or wipe it from another computer. For iPhones and iPads, Find My iPhone does the same. This won't get your hardware back, but it prevents someone from accessing your data.

Think about what's actually on your machine. Client names, addresses, phone numbers, email threads about sensitive topics, financial records, employee details. Under UK GDPR, you're responsible for protecting that information. A stolen unencrypted laptop containing client data is a data breach you'd need to report to the ICO — and to every affected client. The reputational damage alone can sink a small business.

The fixes that take 10 minutes or less

You don't need to do everything at once. Start with the ones marked "critical" — they're free and fast. Then work through the rest over the next week.

Critical (do these today)

  1. Encrypt your drive. Windows Pro: right-click C: drive → Turn on BitLocker. Follow the prompts to save your recovery key (print it, don't save it on the same computer). Mac: System Settings → Privacy & Security → FileVault → Turn On. Ten minutes, free, and it protects everything on the machine.
  2. Turn on 2FA for your email. This is your most important account. For Microsoft 365: go to your Microsoft account security settings → "Additional security" → turn on two-step verification. For Google: myaccount.google.com/security → 2-Step Verification. Five minutes.
  3. Set a strong password on your laptop. Not your dog's name. Not "password123." Use a passphrase — four or five random words stuck together, like "correct-horse-battery-staple." Write it down somewhere safe, not on a sticky note on the screen.

Important (do these this week)

  1. Get a password manager. Bitwarden is free and works on everything. Stop reusing passwords. Stop keeping them in a spreadsheet called "passwords.xlsx." A password manager generates strong unique passwords for every account and remembers them for you. You only need to remember one master password.
  2. Remove old users from shared accounts. Spend ten minutes going through your key services — email admin, cloud storage, social media, domain registrar, accounting software — and remove anyone who shouldn't have access anymore. If you're not sure how, Google "how to remove users from [service name]" or ask me.
  3. Set up a backup reminder. Even if you're not ready to set up automatic cloud backups yet, put a recurring calendar reminder every Friday afternoon: "Back up Documents folder to external drive." It takes five minutes. An imperfect manual backup you actually do is infinitely better than a perfect automated system you never set up.

Worth doing (next fortnight)

  1. Set up cloud backup. Backblaze or iDrive, £6/month. Install, forget about it, sleep better. It backs up everything continuously and keeps old versions. If your laptop dies tomorrow, you download your files onto a new machine and carry on.
  2. Check your domain registrar's security settings. Turn on 2FA. Make sure the recovery email address is one you actually check. Enable "domain lock" to prevent unauthorised transfers.
  3. Do a data map. Take the list you made for Question 1 and turn it into a simple document. Where is everything? Who has access? When was it last backed up? Keep it updated. If you're ever ill or on holiday and someone needs to find something, this document is gold.

What if you don't have time for any of this?

I get it. You're running a business. The printer's jammed, there's a delivery due at 2pm, and you've got three quotes to send before lunch. Data security feels abstract — important, but never urgent. Until it is.

That's what I do. I sit down with local businesses for a one-hour data safety review. We go through the five questions together, I point out the gaps, and I fix the quick wins on the spot — drive encryption, 2FA setup, removing old users, checking backups. You finish the hour with a short written report of what we found and what still needs doing, and the most dangerous gaps are already closed.

Most of my clients are in Nottingham, Derby, Long Eaton, and the surrounding areas. I come to you, at a time that works around your business. The first phone call is free and there's no obligation — sometimes ten minutes on the phone is enough to spot the biggest issue and tell you how to fix it yourself.

Here's roughly what it costs through me:

What you get My price
One-hour data safety review — I visit your business, go through all five questions, fix quick wins on the spot, give you a written report £60
Cloud backup setup (Backblaze or iDrive, installed per computer, including first backup verification) from £50/computer
Full security setup — drive encryption, 2FA on all critical accounts, password manager, user access audit, backup configured and tested from £150
Quarterly security check-in — verify backups, check for unauthorised account access, update your data map £30/quarter

Plus any cloud subscription costs — I don't mark those up. You pay whatever Backblaze or your password manager charges directly.

A few things worth knowing before you start

BitLocker is only in Windows Pro

If your laptop came with Windows Home, BitLocker isn't included. You can upgrade to Windows Pro through the Microsoft Store for about £120, or you can use VeraCrypt (free, open-source) which does the same thing. I can help with either — upgrading to Pro is cleaner and takes about ten minutes.

2FA isn't perfect, but it's close

No security measure is 100% foolproof. Determined attackers can sometimes bypass 2FA through phishing or social engineering. But for the kind of opportunistic attack that hits most small businesses — someone guessing a weak password, using a password leaked from another site, or buying credentials on the dark web — 2FA stops it cold. It raises the bar from "trivial" to "not worth their time."

Your phone is a computer too

Everything in this guide applies to your phone as well. It has a password or biometric lock (face/fingerprint), right? Is it set to wipe itself after ten wrong attempts? If you do online banking or access client emails from your phone, it's carrying business data. If you lose it on the bus, can someone get in? Check your lock screen settings today.

Write down your recovery codes

When you turn on 2FA, every service will give you recovery codes — a list of one-time-use codes to get back in if you lose your phone. Print them. Put them in a safe place. Not on your computer. Not in your email. A physical piece of paper in a drawer or a safe. I've had clients lock themselves out of their own accounts because they saved the recovery codes in the very email account they couldn't access. Don't do that.

Worried about your business data? Let's check it together

I'm based near Long Eaton and cover Nottingham, Derby, and the surrounding areas. If you'd rather someone else went through these five questions with you — and fixed the problems on the spot — send me a message. The first chat is free and there's no pressure.

Get in touch Back to guides