Ask your IT provider whether the business is backed up and you will usually get a reassuring answer. The server has a mirrored drive. The CRM vendor promises continuous data protection. Someone on the team exports the client list to a spreadsheet every quarter, just in case. Plenty of copies, so the data must be safe.
Except those copies are doing different jobs, and none of them may be a backup in the sense that matters. The mirrored drive is replication, a live copy that changes whenever the original changes. The spreadsheet exports are duplication, frozen copies that drift out of date the week they are taken. Confuse the two jobs and you can lose everything to ransomware while holding six copies of your client list, every one of them encrypted or stale.
What choice are you actually facing?
You are choosing between two ways of copying data that behave very differently. Replication keeps a second copy synchronised with the live system, so operations continue when hardware fails. Duplication creates an independent copy, frozen at a point in time, that nobody updates. Replication exists to keep the business running. Duplication exists to preserve the data. They are not interchangeable.
Replication comes in two main flavours. Synchronous mirroring writes every change to two places at once, so the second copy is always current and can take over the moment the first fails. Asynchronous replication pushes changes to a remote location with a short delay, trading perfect currency for geographic distance. Your cloud file sync, your CRM vendor’s continuous data protection and the mirrored drives in the office server are all versions of the same idea.
Duplication is simpler. Copying a folder to an external drive. Exporting the client list before a campaign. Archiving last year’s project files. Each copy then lives its own life. And in a typical owner-managed business, nobody chose this arrangement deliberately. The IT provider set up the mirroring, the software vendors handle their own replication, and the informal copies accumulated on their own.
When is replication the right call?
Replication is the right call when downtime is the risk you are managing. If a drive fails, a mirrored copy takes over immediately. If a provider has an outage, an off-site replica keeps the service available. Anywhere the business cannot tolerate hours offline, a synchronised live copy is what keeps trading, invoicing and client work moving without interruption.
The logic shows up in regulation. The Financial Conduct Authority’s operational resilience rules required regulated firms to identify their important business services and prove, by March 2025, that they could stay within defined impact tolerances during a disruption. Your firm is almost certainly outside the FCA’s scope, but the underlying question travels well. Which services would threaten the business if they were down for 48 hours, and what keeps them running?
The limit matters just as much. Replication copies everything faithfully, including the things you wish it would not. Delete a folder by mistake and the deletion mirrors within seconds. Let ransomware in and the encryption replicates too. Arcserve’s disaster recovery guidance is blunt about this. Mirroring keeps you available, but it holds no history to fall back on, so it can never stand in for a backup.
When is duplication the right call?
Duplication is the right call when you need a copy that cannot be touched by whatever damages the live system. A backup taken last night and stored offline survives the ransomware that encrypts everything still connected. An archive frozen at year end survives the botched migration in January. Duplication gives you history, and history is what you restore from.
The National Cyber Security Centre’s guidance for small organisations recommends keeping several backups, with at least one copy not permanently connected to your network, and mixing online and physical storage so that losing one does not mean losing all of them. Security vendors such as Commvault go further for firms worried about ransomware, recommending immutable backups, written once and unchangeable, so an attacker who reaches them still cannot corrupt them.
The limit here is control. Duplication done informally multiplies versions of the truth rather than protecting it. The quarterly CRM export goes stale within days, yet it sits in a shared folder holding personal data that no retention policy covers. Ten copies of a client list give you ten places an erasure request can fail, and no extra safety at all. Duplication earns its keep when each copy is labelled, dated and governed, and becomes a liability when it happens by habit.
What does it cost to get this wrong?
Get it wrong in one direction and you lose the business’s memory. Treat a mirrored drive as your backup and a single ransomware infection encrypts the original and the mirror together, leaving nothing clean to restore. Get it wrong in the other direction and you drown in stale copies that corrode data quality and multiply your exposure under UK GDPR.
The data quality cost has numbers attached, even if they come from bigger organisations. In Experian’s research, organisations believed on average that 32 per cent of their data was inaccurate, and put 27 per cent of revenue down to waste caused by inaccurate or incomplete customer and prospect data. Oracle’s guidance on data duplication frames the same problem as governance rather than housekeeping, because duplicate records inflate storage, distort reporting and soak up staff time. Scale that down to a 15-person firm and it looks like hours lost reconciling records, campaigns emailing the same client twice, and reports nobody quite trusts.
The compliance cost turns directly on the distinction. Replicated systems count as live data under UK GDPR, so an erasure request has to take effect across every replica, and a lagging or failed replica leaves you holding data you told someone you had deleted. Documented backups get some flexibility. Commentary on GDPR and database backups notes that immediate deletion from archives is not demanded, provided retention periods are documented, explained and honoured. Ad hoc exports and personal copies get no such allowance, and the ICO’s expectations on data minimisation and storage limitation assume you know where personal data lives. Many firms holding informal copies could not say.
What should you ask before you decide?
Start by mapping what already exists, because in an established owner-managed business the choice has usually been made for you by default. An hour of pointed questions to your IT provider, your key software vendors and your own team will tell you which copies are replicas, which are backups, and which are unmanaged strays that belong to neither category.
Five questions do the work:
- Which of our systems are replicated for continuity, and has anyone ever tested the failover?
- What backups exist, how often are they taken, and is at least one offline or immutable?
- If ransomware got in tomorrow, could it reach every copy we hold?
- Where does personal data live outside the core systems, and who would find it after an erasure request?
- Which system is the single source of truth for customer records, and does the team know that?
The answers usually point to two or three changes rather than a project. Add an offline backup where mirroring was being trusted as one. Declare the CRM the single source of truth and stop the informal exports, or give them retention dates and a home. Write down what each remaining copy is for.
None of that needs enterprise budgets or a resilience team. It needs one distinction held clearly. Replication keeps the business running. Duplication preserves what the business knows. Give each job to the pattern designed for it, and the copies you hold start protecting you instead of multiplying your risk.
