What it means
Every business depends on data: invoices, customer contacts, contracts, inventory counts and the accounting ledgers. When any of these become unavailable or unreliable, work stops or decisions are made on bad information.
Data loss comes in two forms, loss of availability (you cannot get at the data) and loss of confidentiality (someone else has it). Common causes include accidental deletion, disk failure, power cuts, software bugs, ransomware, theft of devices, natural disasters and malicious insiders.
Surveys and security reports often find that human error plays a large part. Cloud services shift some of the risk to the provider but do not remove the customer's own responsibility to protect and back up the data.
The financial costs are direct and indirect. Direct costs include recovery work, replacing equipment, legal fees, notifying customers and regulatory penalties.
Indirect costs include lost sales during downtime, staff time, damage to reputation and customers who leave. Prevention rests on a few basics.
Regular, tested backups stored separately from the main system, access controls, encryption, security updates, staff training and a documented recovery plan reduce both the chance and the impact. Two measures guide the planning: the recovery point objective, which is how much data the business can afford to lose, and the recovery time objective, which is how long it can afford to be without it.
The nuance is that a backup that has never been tested is only a hope. Many businesses discover during an incident that backups were incomplete, out of date or stored on the same network as the original data.
A regular restore test is a cheap way to prove that the plan works.
In practice
Real-world examples.
Example
A small architecture firm stores all its drawings on one office server. A power surge destroys the disk, and the only backup is six months old. The firm spends three weeks recreating drawings and loses a client who was waiting for plans.
Example
An online retailer is hit by ransomware that encrypts its order database. Because it holds daily offline backups, it restores the system within 8 hours and loses only a few orders. It refuses to pay the ransom and reports the incident to its insurer.
Example
A sales manager leaves a laptop in a taxi, and it holds unencrypted customer lists. The company cannot be sure that no one has accessed the files, so it must treat the event as a potential breach and notify the regulator. Full-disk encryption would have avoided the problem.
Formula
Calculation
Annualised expected loss = probability of a loss event in a year x financial impact of the event
Suppose a company estimates a 4% chance each year of a major data loss event, with an impact of $750,000 in recovery costs, lost sales and penalties. Expected annual loss = 0.04 x 750,000 = $30,000. A backup and recovery upgrade costing $12,000 a year that lowers the probability to 1% would reduce the expected loss to 0.01 x 750,000 = $7,500, a saving of 30,000 - 7,500 = $22,500, which exceeds the $12,000 cost by $10,500.Case study
Seen in the real world.
Oakhaven Property Management is an illustrative, fictional company that collects rent for 1,500 apartments. Its tenancy records and ledgers were kept on a single cloud account, and an employee who left on bad terms deleted a large set of files before his access was removed.
The company had a backup, but it was configured to overwrite itself every seven days, so the oldest copy already contained part of the damage. Rebuilding the missing records from emails and bank statements took six staff members nearly a month and delayed rent reconciliations.
Afterwards, the finance director set up versioned backups held for 90 days, removed access immediately when staff leave, and added a quarterly restore test. In this illustrative story, the cost of the improvements was about $9,000 a year, compared with an estimated $85,000 of staff time and lost income from the incident.
Watch out
Common mistakes.
- Assuming that cloud storage is a backup, when files deleted or encrypted in one place may be deleted or encrypted everywhere they synchronise.
- Never testing backups, so the first attempt to restore is during an emergency.
- Ignoring lost or stolen devices, when unencrypted laptops and phones are a common source of data loss and breaches.
Questions
People also ask.
What is the difference between data loss and a data breach?
Data loss means data is destroyed or unavailable, while a breach means unauthorised people have accessed it, and one incident can be both.
What is a good backup rule?
Many advisers suggest keeping at least three copies of important data, on two different types of storage, with one copy kept offsite or offline.
Does insurance cover data loss?
Cyber and similar policies may cover recovery and related costs, but they have limits and conditions, so check the wording and keep your controls up to date.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%