Secure Storage at Home: Drives, NAS and Cloud, Explained

The three ways people actually lose files

It's rarely a dramatic hack. The far more common story is a bag left on a train, a phone dropped down a flight of stairs, or a hard drive that simply stops working one Tuesday morning with no warning at all. These three things, loss, theft and hardware failure, account for the overwhelming majority of personal data disasters that ordinary households experience.

Think about what lives on your devices right now. Baby photos. Tax returns. Scanned passports. Years of emails. A stolen laptop handed to the wrong person gives them access to all of it, unless something is protecting those files even when the device is out of your hands. A dead hard drive with the only copy of your wedding photos is just gone. No amount of technical skill brings it back.

The good news is that protection against all three of these threats is genuinely available to ordinary people, most of it already switched on, and none of it requires a technical background to understand or use. The rest of this piece explains each layer in plain terms, so you can make informed choices rather than just hoping for the best.

Act on this today: Open your phone's settings and search for "encryption" or "device protection". Make a note of what you find. That's the starting point.

Device encryption: the protection you probably already own

Encryption sounds intimidating. It isn't, at least not in terms of what you need to understand to benefit from it. The short version: encryption scrambles the data on your device so that it reads as meaningless noise to anyone who doesn't have the right key. That key is, in practice, your PIN, password or biometric.

Here's the part most people don't know. If you bought an iPhone in the last several years, it's been encrypted since the moment you set it up. Android phones from reputable manufacturers have shipped with encryption on by default for some time now, though it's worth checking your own settings to be certain. The NCSC's device security guidance confirms this and explains what to look for on different platforms.

On computers the picture is slightly more varied. Macs running modern versions of macOS have FileVault, Apple's full-disk encryption, which is either on by default or prompted during setup. Windows has BitLocker on Pro and Enterprise editions, and a more limited "device encryption" on Home editions, which activates automatically on newer hardware when you sign in with a Microsoft account. If you're unsure whether your Windows machine is encrypted, type "device encryption" into the Start menu search bar. The settings page will tell you plainly.

What does encryption actually protect you against? Specifically: someone who gets physical access to your device without your password. If your laptop is stolen and the thief removes the hard drive and plugs it into another machine, encrypted data is unreadable to them. Without the key, they have a very large pile of scrambled nonsense. This is meaningful, real protection.

What it doesn't protect against: someone who gets your password, or someone who accesses your files while the device is unlocked and running. Encryption is a lock on the door, not a guard inside the house.

One practical point that often gets overlooked: a strong PIN or password matters enormously here. A six-digit PIN is far better than a four-digit one. A proper passphrase is better still. The encryption is only as strong as the key protecting it.

Act on this today: Check whether encryption is enabled on your laptop. On Windows, search "device encryption" in settings. On a Mac, go to System Settings, then Privacy and Security, then FileVault. If it's off, turn it on.

External drives: cheap, useful, and easy to get wrong

External hard drives and USB sticks are genuinely useful. They're affordable, they work without an internet connection, and they let you keep a copy of your files somewhere separate from your main device. The problem is that most people use them in ways that give a false sense of security.

The most common mistake: using an external drive as the only copy of something important. People move their photos off a laptop to free up space, put them on an external drive, and then treat the drive as the archive. When the drive fails (and mechanical drives do fail, often without warning), those photos are gone. An external drive is a backup only if your files also exist somewhere else.

The second common mistake: assuming an external drive is private because it's physical. An unencrypted USB stick or external hard drive is completely readable by anyone who picks it up and plugs it in. No password prompt. No barrier at all. If you carry one in your bag, or keep one somewhere it could be taken, that's worth thinking about.

Encrypting an external drive is possible and not particularly complicated. On a Mac, you can right-click a drive in Finder and choose "Encrypt". On Windows with BitLocker available, you can encrypt a drive through File Explorer. There are also open-source tools that work across platforms, though naming specific products falls outside what this piece is here to do. The category you're looking for is "full-disk encryption for removable media".

When does encryption on an external drive matter most? If you travel with it, if it contains sensitive documents (financial records, medical information, anything you'd be uncomfortable with a stranger reading), or if it's kept somewhere other than your own locked home. A drive that never leaves your house and lives in a locked drawer is lower risk. A drive in your work bag is a different matter entirely.

USB sticks deserve a special mention. They are small, easy to lose, and frequently unencrypted. The NCSC's guidance on removable media is clear that unencrypted removable storage is one of the more common routes by which sensitive data ends up in the wrong hands. If you use USB sticks for anything sensitive, encrypt them.

Act on this today: Check any external drives or USB sticks you use regularly. Are they encrypted? Do they contain files that only exist there and nowhere else? Those are the two questions that matter.

The NAS, in plain English: your own private cloud

NAS stands for Network Attached Storage. That name is not particularly helpful. A better description: a small box you plug into your home router that holds one or more hard drives, and makes your files available to all your devices at home (and, if you set it up that way, from outside your home too). Think of it as a private cloud that lives in your cupboard rather than in a company's data centre.

Why would someone want one? A few reasons. Your files stay on hardware you own and control. No company has access to them. No subscription fee to keep your own data. If you have a lot of data, photos especially, a NAS can hold far more than most cloud storage plans offer at the free tier. And because it sits on your home network, transferring large files to and from it is fast.

It's not without trade-offs. A NAS requires some setup, more than plugging in a USB drive. You need to think about user accounts, access controls, and whether you want to allow access from outside your home network (and if so, how to do that safely). You're also responsible for the hardware. If both drives in your NAS fail simultaneously, and you have no other backup, you've lost your files just as surely as if the hard drive in your laptop died.

A well-configured NAS typically uses something called RAID, which means it writes your data across multiple drives simultaneously so that if one drive fails, the others keep your files intact. This is not a backup. It protects against a single drive failure, not against the NAS being stolen, flooded, or catching fire. RAID and backup are different things, and conflating them is a mistake even technically experienced people make.

On the privacy side, a NAS is genuinely appealing. Your holiday photos are on your hardware, not analysed by an algorithm, not subject to a company's terms of service, not potentially used to train a machine learning model. The ICO's UK GDPR guidance is largely about what organisations must do with data, but it illustrates clearly why the terms under which companies hold personal data matter. A NAS sidesteps that entirely for your home files.

Who is a NAS actually for? Someone who has a lot of files and values control over them. Someone who wants to share files between family members at home without routing everything through a cloud service. Someone comfortable doing a bit of initial setup and occasional maintenance. It's not the right answer for everyone, and it doesn't replace off-site backup, but for the right household it's a genuinely good option.

Act on this today: If you're curious about a NAS, look up the term "home NAS setup" on a reputable technology site to get a sense of what's involved before committing. The setup complexity varies enormously between different devices.

Cloud storage, honestly: what you gain and what you hand over

Cloud storage is convenient in ways that are genuinely hard to argue with. Your photos back up automatically. You can access any file from any device. If your laptop is stolen, your files are still there, waiting for you on a new machine. For many people, cloud storage has already saved them from data loss without them even realising it.

But "the cloud" is not a neutral term. It means someone else's computers, operated by a company, under that company's terms of service, in jurisdictions that may or may not be the UK. When you store files with a cloud provider, you are making a trust decision, whether you've thought about it that way or not.

What are you actually handing over? The files themselves, obviously. But also metadata: when files were created, modified, where photos were taken (if location is embedded), what devices you use. Depending on the provider and the service, your files may be scanned for various purposes. Some providers scan for illegal content, which is a legitimate legal obligation. Some also use file data to improve their services, train models, or inform advertising. The specifics are in the terms of service and privacy policy, which most people don't read.

This is the kind of arrangement that our piece on how your data is collected and sold covers in detail. The short version here: free cloud storage is rarely free in the sense of costing nothing. The cost is often your data and attention.

Paid cloud storage is somewhat different. When you're paying for a service, the company's incentive to monetise your data separately is reduced, though not eliminated. Reading the privacy policy of any cloud service you use is genuinely worthwhile, not because you'll necessarily stop using it, but because you'll make an informed choice rather than an accidental one.

There's also the question of how cloud storage fits into the broader picture of how companies track you online. Your cloud account is often linked to your email, your browser, your calendar, your contacts. That linkage is convenient, and it's also how companies build detailed profiles across services. None of this means cloud storage is bad. It means the trade-off is real and worth understanding.

One technical point that genuinely matters: end-to-end encryption. Most mainstream cloud storage is encrypted in transit (between your device and their servers) and at rest (on their servers). But the provider holds the encryption keys, which means they can read your files if required to by law, or if their security is breached. A smaller number of services offer end-to-end encryption, sometimes called zero-knowledge encryption, where the provider cannot read your files because they don't hold the keys. This is meaningfully more private. The trade-off is usually that you lose some features (like server-side search or thumbnail previews) and if you forget your password, your files may be unrecoverable.

The EFF's Surveillance Self-Defence guide has useful background on what different types of encryption actually protect you against, if you want to go deeper on this.

Act on this today: Find the privacy policy for whichever cloud storage you use. Search it for the words "train", "improve", and "third party". See what it says. You don't have to change anything. Just know what you've agreed to.

Privacy and backup are two different jobs

This is perhaps the most important thing in this entire piece, and it's also the thing most people get muddled. Privacy and backup solve different problems. Treating one as a substitute for the other leaves you exposed in ways you might not notice until it's too late.

Backup solves the problem of losing your files. It means having copies in multiple places so that no single failure, whether hardware, theft, or disaster, can wipe out everything. A good backup means that even if your laptop is destroyed, you can recover your files.

Privacy solves the problem of the wrong people accessing your files. It means that even if someone gets hold of your device or your storage, they can't read what's on it. Encryption is the main tool here. So is choosing storage providers whose terms you're comfortable with.

These two goals can conflict. The most private approach to storage, keeping your only copy on an encrypted drive in your house with no cloud backup, is terrible for backup. The most convenient backup approach, automatic cloud sync with a major provider, may involve trade-offs on privacy. A sensible household plan addresses both, separately, rather than assuming that solving one solves the other.

A locked, encrypted NAS with no off-site backup is private but not safe from fire or flood. An unencrypted external drive with a copy of everything is a good backup but a privacy risk if stolen. Cloud storage with a reputable provider is a good off-site backup but involves a company holding your files. None of these is simply right or wrong. They're choices with different profiles of risk and trade-off.

Understanding this distinction also helps you prioritise. Not everything needs the same level of both. A folder of publicly available documents you downloaded from the internet needs backup (so you don't have to re-download them) but not much privacy protection. A folder of financial records needs both. Your approach can be calibrated accordingly.

Act on this today: Make a mental list of the files on your devices that would be most damaging to lose, and separately, most damaging for a stranger to read. Those two lists may overlap, but they may not. That distinction shapes what protection each file actually needs.

A household plan that actually gets followed

The best storage plan is one a real household will actually maintain. A complicated system that requires technical effort every week will be abandoned. A simple system that mostly runs itself will persist.

The principle used by people who take data seriously is often summarised as the 3-2-1 rule: three copies of anything important, on two different types of storage, with one copy off-site. That sounds technical but it translates into very ordinary behaviour.

Here's what a workable household plan looks like in practice:

Your devices

Make sure encryption is on for every device in the household, phones, laptops, tablets. Use strong PINs and passwords. This protects you against loss and theft. It costs nothing and requires almost no ongoing effort once it's set up.

A local backup

Keep a copy of your important files somewhere other than your main device, but still at home. This could be an external hard drive you back up to weekly, or a NAS that your devices sync to automatically. This protects you against hardware failure. If the drive you're backing up to is encrypted, it also protects you against that backup being stolen or accessed by someone else.

Automate this if you can. Manual backups get forgotten. On a Mac, Time Machine does this automatically to an attached drive or NAS. On Windows, File History or a third-party backup tool can do the same. The category of software you're looking for is "automated local backup".

An off-site backup

One copy needs to be somewhere physically separate from your home. If your house floods, burns, or is burgled, you don't want all your copies in the same place. Cloud storage is the most practical way most households achieve this. A paid service with decent terms is preferable to a free one if your files are sensitive. If you're concerned about what a cloud provider can see, look for services that offer end-to-end encryption.

Alternatively, some people keep a second external drive at a family member's house or workplace and swap it periodically. This is more effort but keeps your files entirely off commercial cloud infrastructure.

What to back up

Not everything. Focus on what can't be replaced: photos, personal documents, financial records, creative work. Installed software can be reinstalled. Downloaded files can often be re-downloaded. Concentrate your backup effort on irreplaceable things.

Test it occasionally

A backup you've never tested is a backup you don't know works. Once or twice a year, try actually restoring a file from your backup. It takes five minutes and it's the only way to know your system is functioning.

Passwords and accounts

If your storage relies on accounts (cloud services, NAS admin accounts), those accounts need strong, unique passwords. A password manager (the category, not any specific product) stores these securely so you don't have to remember them all. This is a separate layer of protection that sits alongside everything else.

The NCSC's top tips for staying secure online cover password hygiene and account security in accessible terms, and are worth a read alongside this piece.

A realistic summary

• Encryption on: all devices, all external drives that leave your home
• Local backup: automated, to an external drive or NAS, at least weekly
• Off-site backup: cloud storage or a drive kept elsewhere, updated regularly
• Strong passwords on all accounts, managed with a password manager
• Test a restore once or twice a year

That's it. Five things. None of them require technical expertise, just a bit of initial setup and the occasional check. The point isn't perfection. The point is that when something goes wrong, and something will eventually go wrong, you're not starting from nothing.

One copy is none. Two copies in the same place is one. Off-site matters. And privacy and backup, though they work well together, are solving different problems. Keep both in mind, and you're in a genuinely good position.

Act on this today: Write down where your important files currently exist. How many copies are there? Are any of them off-site? That honest audit is the starting point for building a plan that will actually hold up when you need it.