If your phone disappeared right now — dropped in the river crossing at Barra, stolen from a taxi, or simply gone after a factory reset gone wrong — could you still tell a customer what they ordered last month, or what they still owe you? For a large share of Gambian businesses, the honest answer is no. The customer list lives in WhatsApp. The order history lives in a notes app. The product photos live in the camera roll. It all lives in one place, on one device, with no copy anywhere else.
That's not carelessness — it's simply how most small businesses grow, one saved contact and one photo at a time, without ever deciding "this is now business-critical data that needs a backup plan." The fix doesn't require a technical background or a monthly subscription. It requires understanding one simple rule and spending about twenty minutes setting it up.
The 3-2-1 Rule, in Plain Terms
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommends what's widely known as the 3-2-1 backup rule: keep three copies of your important data, on two different types of storage, with one of those copies kept somewhere else entirely — not in the same bag, shop, or building as the original.
In practice, for a small business, that usually looks like:
- Copy 1 — the original. The data as it currently lives on your phone or laptop.
- Copy 2 — a different type of storage. An external hard drive, a USB flash drive, or a second device, kept physically separate from the first.
- Copy 3 — off-site. A cloud backup (Google Drive, Google Photos, or similar), so that even if the shop burns down, floods, or is broken into, the data isn't lost along with the hardware.
CISA's guidance is direct about why the third copy matters so much: a backup kept in the same room as the original doesn't protect against theft, fire, flooding, or a single bad power surge frying both devices at once. The whole point of "off-site" is that whatever happens to your shop or your phone, the off-site copy is unaffected.
Start With What's Already Free on Your Phone
Most Gambian businesses don't need to buy backup software. The tools are already installed.
For WhatsApp Business chats — which for many businesses is the customer list and the order book — WhatsApp's own Help Center lays out the path: open Settings → Chats → Chat backup, choose a Google Account (Android) or iCloud account (iPhone) to back up to, and pick a frequency — daily, weekly, or monthly. Daily is worth the extra few seconds of upload time if chats are where orders and prices get confirmed. While you're there, WhatsApp also offers end-to-end encrypted backup, protected by a password or a 64-digit key only you hold — worth turning on if chats contain sensitive customer or payment details, but only if you're confident you (or someone you trust) will keep that password somewhere safe. An encrypted backup with a forgotten password can't be recovered by WhatsApp or anyone else.
For photos, product images, and documents — Google's own support documentation for Google Photos explains the setup: open Google Photos, sign in, tap your profile picture, go to Photos settings → Backup, and turn it on. Every Google account comes with free storage shared across Gmail, Google Drive, and Google Photos, which is usually enough for a small business's photo library for quite a while before anything needs to be paid for.
Between those two settings — WhatsApp's chat backup and Google Photos' automatic backup — a business covers its two most common failure points: losing the conversations where business actually happens, and losing the product photos that took real time to create.
Add a Second, Offline Copy
Cloud backup alone satisfies "off-site," but not "two different media types," and it depends on having internet access to restore from — not guaranteed during a network outage or after a compromised account locks you out. This is where a simple USB flash drive or external hard drive earns its place: periodically (monthly is reasonable for most small businesses) copy exported chat backups, invoices, and photo folders onto it, and keep it somewhere other than next to the primary device — a different room, or with a trusted family member or business partner. It doesn't need to be sophisticated. It needs to exist and be current.
The Step Almost Everyone Skips: Testing the Restore
CISA's guidance makes a point that's easy to miss: a backup is only useful if you've confirmed you can actually get the data back out of it. Once a quarter, actually try it — open the Google Drive backup and confirm a chat restores, or plug in the external drive and open a few files to make sure they're not corrupted or years out of date. A backup nobody has ever opened is an assumption, not a safety net.
If Something Does Go Wrong
Two things are worth knowing in advance, before an incident forces you to figure them out under pressure. First, if a device is lost or stolen, changing the passwords on the linked Google or email account immediately limits what anyone who finds it can access — a backup doesn't undo the exposure of data still sitting unprotected on the device itself. Second, The Gambia has its own national incident response body, gmCSIRT, operating under the Public Utilities Regulatory Authority, which coordinates cybersecurity incident response and publishes security advisories for Gambian organizations. It's a legitimate channel to know about — most businesses will never need to file a report there, but it's worth knowing it exists before the day it might matter.
A Twenty-Minute Starting Checklist
- Turn on WhatsApp Business chat backup (daily, if chats carry real business detail).
- Turn on Google Photos backup for product images and documents.
- Copy anything irreplaceable onto a USB drive or external hard drive, kept in a different location.
- Set a recurring reminder — monthly is fine — to actually test that a backup restores.
- Write down (on paper, not just in your head) which accounts hold which backups, so it isn't only one person's knowledge.
None of this requires a technical hire or a backup budget. It requires deciding, once, that the records your business runs on deserve the same protection as the cash in the drawer — and then spending twenty minutes making sure a lost phone stays an inconvenience, not a catastrophe.
