Backing up accounting data: the 3-2-1 rule
The 3-2-1 rule (three copies, two media, one offsite) protects accounting data, to be kept for ten years. Backup method and the conservation obligation.
Expert note: This article was written by our chartered accountancy firm. Information is current as of 2026. For a personalised review of your situation, contact us.
Quick answer. The 3-2-1 rule sums up a good backup policy: three copies of the data, on two different types of media, including one copy kept offsite. Applied to accounting data, it protects against loss, failure and disaster. It dovetails with the legal obligation to keep accounting documents and their supporting documents for ten years (Commercial Code art. L123-22).
Accounting data is both vital for the company and mandatory to keep for ten years. A data loss can disrupt the activity and create a risk in case of an audit. The 3-2-1 rule is the reference method to protect against it. Here is how to apply it, and how it dovetails with the conservation obligation.
The 3-2-1 rule explained#
The 3-2-1 rule is a simple and robust backup standard.
It holds in three figures: three copies of the data, including the production data and two backups; two different types of media, so as not to depend on a single technology; one offsite copy, kept elsewhere than on the premises. This combination protects against the three major risks: accidental deletion, hardware failure and a local disaster such as fire or theft.
The strength of the rule is its redundancy: to lose the data, all three copies, on two media and in two places, would have to disappear at the same time, which is highly improbable.
The application to accounting data#
Accounting data calls for particular vigilance, because its conservation is an obligation.
Accounting documents and supporting documents must be kept for ten years from the closure of the financial year (Commercial Code art. L123-22). In computerised accounting, the accounting entries file must be presentable to the tax authority. The backup therefore serves not only business continuity: it guarantees that this data stays available and intact throughout the legal period, including in case of an audit.
A company that lost its accounting data would face both disruption and a risk in case of an authority request. The backup secures the conservation obligation, a subject linked to the overall rigour of the SME accounting obligations.
Testing the restore#
The most neglected point of a backup policy is the restore test.
A backup is only worth its ability to be restored. Too many companies discover, on the day of the incident, that their backups were corrupted, incomplete or impossible to restore. Regularly testing the restore, on a separate environment, is the only way to ensure the backup actually works. This test is an integral part of a well-applied 3-2-1 rule.
| Rule element | Objective |
|---|---|
| Three copies | Redundancy against loss |
| Two different media | Not depending on one technology |
| One offsite copy | Protect against a local disaster |
| Restore test | Check the backup works |
Our view#
Backing up accounting data is not a purely technical subject: it is a condition of business continuity and of compliance with the ten-year conservation obligation. The 3-2-1 rule offers a simple framework, within reach of any company.
Our advice is to apply the 3-2-1 rule, favour a cloud copy for the offsite, and above all regularly test the restore, a step too often forgotten. For accounting data, you must also check that the backup retention period covers the ten legal years, and that the storage respects the data location rules. A well-thought-out backup turns a potentially serious incident into a mere setback.
A common case#
A company kept its accounting data on a single local server, with no externalised copy. A hardware failure made the data inaccessible, just before an authority request. The reconstruction was long and costly. Setting up a 3-2-1 rule, with an offsite cloud copy and a quarterly restore test, has since secured the data. The cost of the solution was nothing compared with that of the loss avoided.
Frequently asked questions
What is the 3-2-1 rule?+
It is a backup standard: three copies of the data, on two different types of media, including one copy kept offsite. This redundancy protects against accidental deletion, hardware failure and a local disaster.
How long should accounting data be kept?+
Accounting documents and their supporting documents must be kept for ten years from the closure of the financial year (Commercial Code art. L123-22). The backup must therefore guarantee their availability throughout this period.
Why an offsite copy?+
To protect the data against a local disaster, such as fire, theft or flood, which would destroy both the production data and the backups kept on site. An externalised copy, often cloud, meets this need.
Should you test your backups?+
Yes, it is essential. An untested backup can be corrupted or impossible to restore on the day of the incident. Regularly testing the restore, on a separate environment, is the only guarantee that it works.
Is the cloud enough for backup?+
The cloud is an excellent medium for the offsite copy, but the 3-2-1 rule recommends two types of media. Combining local and cloud storage avoids depending on a single technology or provider.
Where should accounting data be stored?+
The data must be kept on French territory or in a country offering equivalent protection guarantees. You must check the location of backups, notably for cloud solutions.
Key takeaways#
- The 3-2-1 rule: three copies, two different media, one offsite copy.
- It protects against the three major risks: deletion, failure and local disaster.
- Accounting data must be kept for ten years (Commercial Code art. L123-22).
- The backup secures both business continuity and the conservation obligation.
- Regularly testing the restore is essential, and too often forgotten.
- Check the data location, notably for cloud backups.
Article written by the Hayot Expertise firm, registered with the Order of Chartered Accountants of Ile-de-France. Updated for 2026. This article is for information purposes and does not replace an analysis of your own situation.
Article written by Samuel HAYOT
Chartered Accountant, registered with the Institute of Chartered Accountants.
Regulated French accounting and audit firm based in Paris 8, built to support companies across France with a digital and decision-oriented approach.
Sources
Official and operational sources cited for this page.
This topic is part of our service Tax accountant in Paris | CIT, VAT & tax audits
Need a quote or personalised advice?
Our accountancy firm supports you through all your steps. Get a free quote to review your situation and receive a bespoke fee proposal, or contact us directly.