Backups as a Security Measure: How to Properly Set Up and Regularly Test Encrypted, GDPR-Compliant Offsite Backups and Disaster Recovery for Virtualmin Servers of Non-Profit Organizations

Why backups are indispensable for non-profit organizations

Non-profit organizations often manage sensitive member data, donation data, and internal documents. A server failure, a hacker attack, or accidental deletion can have existential consequences. Regular backups are therefore not an option but a duty – especially when personal data is processed. The GDPR requires appropriate technical and organizational measures (Art. 32), which include the backup and restoration of data.

The three pillars of a robust backup strategy

A good backup strategy for Virtualmin servers is based on three principles: 3-2-1 rule (at least three copies, on two different media, one of them offsite), encryption, and regular restoration tests. Only in this way can you ensure that your data is truly available in an emergency.

1. Offsite backups: spatial separation

A backup on the same server is useless if the hardware fails or ransomware encrypts everything. Offsite means that the backup is located at a different location (e.g., with another provider or in another data center). For non-profit organizations, a virtual server with a trusted provider that serves as a backup target is a good option. Alternatively, you can use a web hosting plan with sufficient storage space, provided it supports SSH access or rsync.

2. Encryption: protection of confidential data

Backups often contain personal data. These must be stored encrypted, both during transmission (e.g., via SFTP or rsync over SSH) and at rest (on the storage medium). On Linux, you can create encrypted archives with GnuPG or OpenSSL. Virtualmin also offers the option to protect backups directly with a password. Make sure to store the key securely – preferably offline and not on the server itself.

3. GDPR compliance: documentation and data processing agreements

If you involve external service providers for the backup, you must conclude a data processing agreement (DPA) with them. Also document which data is backed up, how long it is retained, and who has access. The GDPR also requires that you regularly verify and can demonstrate restorability. A backup concept with clear responsibilities is therefore essential.

Setting up backups under Virtualmin

Virtualmin offers integrated backup functions. Under Webmin > Backup and Restore > Backups, you can create schedules and specify a remote server via SSH or FTP as the target. Using rsync over SSH is recommended, as it enables incremental and encrypted transfers. Set up multiple backup jobs: daily incremental backups and weekly full backups. Retain the backups for at least 30 days to be able to restore older versions as well.

Planning disaster recovery

A backup is only as good as its restoration. Test regularly – ideally monthly – the restoration on a separate test server. Document the steps and measure the time required. In an emergency, you should be able to make the server operational again within a few hours. Keep current documentation of the server configuration and installed packages ready for this purpose.

Regular tests: how to do it

• Automated verification: After each backup, have the integrity of the archives checked (e.g., with gpg --verify or tar -tzf).
• Spot checks: Restore individual files or databases to test functionality.
• Full restoration test: Simulate the emergency on a test system and document the process.
• Logging: Record all tests in writing, including date, result, and any problems.

These tests also serve as evidence for GDPR compliance.

Conclusion: security through a holistic backup strategy

For non-profit organizations, a reliable backup concept with encrypted offsite backups and regular restoration tests is the key to data security. With Virtualmin and the right partners, this can be implemented cost-effectively. If you need support with the setup, you can find helpful instructions in our knowledge base or contact us.