Photo Backup for Clients | A Leeds Photographer's Guide

The safest photo backup for clients follows the 3-2-1 rule: three copies of every image, on two different devices, with one copy kept away from the studio — plus one that stays offline altogether. Then you test that you can actually restore from them. If you're the client rather than the photographer, the same rule applies to the finished images once the gallery link lands in your inbox. From that moment, they're yours to look after.

This guide covers both sides of the job: what we do between the memory card and final delivery here in Leeds, and what you should do with your photos once you have them.

Why client photos need a proper backup

A shoot can't be repeated. The light, the expression, the product launch date — all gone once the session ends. The Professional Photographers of America says plainly that technology can fail, and recommends a set routine for every client session: a working backup, a local archive and an off-site copy, with a second copy made the moment images are imported. That one habit covers the most common loss — a drive dying a week after the shoot, before anything else exists.

The risks are worth naming separately, because each needs its own answer. SessionSavvy lists accidental deletion, ransomware, theft, fire, being locked out of an account and plain drive failure. Two folders on the same disk do nothing against that disk failing, and two drives on the same shelf share the same fire.

What is the 3-2-1 rule?

Keep three copies of the files: the original plus two backups. Put them on two different devices or media — an internal drive and an external one, say. Keep one copy off-site, away from wherever the others sit. The US cyber agency CISA's data backup guidance follows the same pattern, and adds that the right mix depends on how sensitive the work is, how much of it there is and how quickly you need it back.

The extra copy people skip

The UK's National Cyber Security Centre makes a point many photographers miss: 3-2-1 on its own doesn't require an offline copy. If every copy is connected to your computer or your network, one ransomware incident can reach the lot. Keep at least one backup unplugged — an external drive in a drawer, or at a relative's house, connected only when the archive needs updating — and test your backups regularly. PPA's 2025 guidance agrees: one drive offline, sensitive drives encrypted, backups scheduled rather than remembered, and restores tested quarterly.

How do you get from memory card to archive?

A backup system earns its keep when it's a routine nobody has to think about. Ours runs like this.

1. The card stays untouched. Don't format it until the computer copy and the external copy both exist and have been checked — advice Oto's workflow guide gives too.
2. Copy to two places straight away. Computer first, then an external drive.
3. Verify, don't assume. Compare file counts against the card and open a few frames at full size.
4. Add the off-site copy within days — cloud, or a drive stored somewhere else.
5. Refresh the offline drive on a schedule, then unplug it again.
6. Deliver from a gallery; archive the originals elsewhere. A client gallery is delivery, not a backup.

In the studio there's one more safety net: we shoot tethered into Capture One, so a first safe copy exists on the computer before a frame has even been reviewed — and you see the shots live as we work. We've written about why we shoot tethered if you're curious.

Cloud, external drive or NAS — which is best?

No single option wins, because they fail in different ways. An external drive is fast, cheap and fully under your control, but it can fail, be stolen or burn with the rest of the kit — so it suits the local copy and the offline copy. A NAS is central and automatic and handles a big archive well, but it stays connected to your network, so one incident can reach it. Cloud storage is off-site by default and easy to automate, which makes it the natural third copy. Local backups are quicker to reach when you need a file today; the off-site copy is what saves you after a disaster at the studio. You want both.

Checking a cloud service before you trust it

The Information Commissioner's Office points out that with cloud storage your files sit on servers the provider controls, so it's on you to judge whether the service is secure and available enough for what you upload. Use a unique, strong password, turn on two-factor authentication where it's offered, and choose between private, public and shared access settings deliberately. The NCSC adds a recovery check worth doing: confirm the service can restore earlier versions and recover deleted data. If it offers neither, treat it as a convenience, not a safety net.

Gallery or download — how should photos be delivered?

Honestly, a good delivery uses both. An online gallery suits the review stage: Aftershoot's delivery guidance recommends a password-protected gallery with a clear expiry window and sensible control over high-resolution downloads. A direct download link suits the final handover of a large set, so nobody has to wrestle with email attachments.

The format should match what the images will do: full-resolution files for print, a smaller sRGB set for screens and social, and a lighter set again if they're going on your website — this guide to optimising images for website performance explains why that matters for page speed.

The catch for clients is the expiry window. A gallery that disappears after a set period is not an archive. Download everything within the first week or two and store it properly.

What should you do with your photos once you have them?

If you've hired a photographer, the delivered files are now yours to protect. A simple routine:

1. Download the full set, not just your favourites, in the highest resolution offered.
2. Save a copy to your computer and a second to an external drive.
3. Add a cloud copy, and switch on two-factor authentication for that account.
4. Keep the unedited originals if your photographer supplies them — we've covered whether to ask for the raw files separately.
5. Name folders with the date and the shoot, for example "2026-10 Team Headshots", so you can find them in two years.
6. Open a few files from each copy to check they work.

This matters most for the images you'll reuse for years. Headshots in Leeds tend to get refreshed every couple of years, not every month, and nobody wants to chase a photographer for a link that expired.

Personal data — a note for UK businesses

Client photos of people are personal data. The ICO treats images of identifiable people held by a business as exactly that, and notes that posting photographs publicly online is likely to go beyond personal or household use, with extra care needed around children's images. So think about who can open the files, how long you keep them and whether a shared link should expire. For a specific question about your own obligations, the ICO is the body to ask.

Ask about backups before you book

Our advice to anyone hiring a photographer, here or anywhere, is to ask three plain questions. Where are my images stored while you work on them? How long will you keep them after delivery? What happens if I lose my copy next year? A confident photographer answers these without hesitation. If the answer is "it's all on one laptop", that tells you what you need to know.

Frequently Asked Questions

What is the best way to store photos long term?

Use more than one place. Keep a copy on your computer, a copy on an external drive and a copy in the cloud or at another address, with one copy that stays unplugged. Open a few files from each copy now and again to check they still work.

How often should I test my photo backups?

PPA's 2025 guidance recommends testing restores quarterly. After each shoot, compare file counts and open sample images too. A backup that has never been restored may be failing without any sign.

Is an online gallery a backup?

No. A gallery is for viewing, choosing and delivering images, and most are set to expire. Download the full set and store it yourself, on at least two devices plus one off-site copy.

How should photographers send large files to clients?

A password-protected gallery or cloud link beats email attachments. Provide full-resolution files for print and a smaller sRGB set for web and social use, and say clearly how long the link stays live.

Is cloud storage safe enough for client photos?

It can be, if you check the service. The ICO advises assessing the provider's security, using a strong unique password and turning on two-factor authentication. The NCSC suggests confirming that version restoration and deleted-data recovery are available.

Where is the studio?

Dock Street Studio is at Unit 9, 30–38 Dock Street, Leeds LS10 1JF — central Leeds, near Leeds Dock, a short walk from Leeds train station, with onsite parking.

Book a shoot with a planned workflow

If you'd like images that are planned, shot and backed up properly, headshots at the studio start from £95 — and if you're a photographer or creator who'd rather shoot your own, photography studio hire in Leeds starts from £125. Book online, email mark@isophotographic.org, or call 0113 4400102.

Written by Mark Wheelwright
Commercial photographer & studio owner, Leeds | ISO Photographic Ltd
Dock Street Studio, Unit 9, 30–38 Dock Street, Leeds LS10 1JF
18+ years' experience | 900+ projects | 300+ five-star reviews | 1M+ shutter count
dockstreetstudioleeds.co.uk

Sources

• Image Backup Best Practices for Photographers, PPA
• Protect Your Photography Data: 3-2-1-1-0 Backup Strategy, PPA
• Offline backups in an online world, NCSC (blog)
• Offline backups in an online world, NCSC (PDF)
• Data Backup Options, CISA
• Cloud computing, ICO
• Paying a data protection fee: other service activities, ICO
• Taking photos in schools, ICO
• A Reliable Photography Backup and File Workflow, SessionSavvy
• Photography workflow: from memory card to client gallery, Oto
• How to Deliver Photos to Clients, Aftershoot