Data protection as a service (DPaaS) is a cloud-delivered service in which a provider runs the platform that backs up, secures and restores your data, whether it lives on servers, laptops, software-as-a-service (SaaS) applications such as Microsoft 365 or Google Workspace, or public cloud workloads. You set the policies, such as what to protect, how often and for how long, and the provider runs the software, storage and infrastructure behind them. DPaaS is a broad label: some services are essentially backup, while others add ransomware protections, retention controls and disaster recovery.
At a glance
- DPaaS is a service, not a product you install: the provider operates the protection platform, and you manage the policies.
- It usually covers backup and restore at a minimum; ransomware protections, legal hold and disaster recovery are included in some services and sold as add-ons in others.
- Coverage varies by provider: servers, virtual machines, endpoints, SaaS apps and cloud workloads are not all supported by every service.
- Immutable or isolated copies can make backups much harder for attackers to destroy, but only if they are configured and tested.
- You remain responsible for deciding what is protected, who can administer it and whether restores actually work.
What problem it solves
Most mid-sized organizations protect data with a patchwork: one tool for servers, another for laptops, native retention in Microsoft 365 that nobody has checked, and cloud workloads someone assumed were backed up by the cloud provider. Gaps show up at the worst time, when a file, mailbox or whole server needs to come back.
Ransomware made the problem sharper. Attackers now commonly go after backups first, deleting or encrypting them so the victim has no choice but to pay. Backups on the same network, with the same administrator accounts, often don’t survive.
DPaaS brings protection under one service and one set of policies, moves the hardware and software upkeep to a provider, and typically adds protections such as immutable backups that are designed to keep copies safe from tampering. It also produces the reporting that auditors and cyber insurers increasingly ask for.
How it works
Connection. The provider’s platform connects to what you want protected, using agents on servers and laptops, application programming interfaces (APIs) for SaaS apps such as Microsoft 365, and connectors for cloud platforms.
Policies. You define what gets backed up, how often and how long copies are kept. Backup frequency sets your recovery point objective (RPO), meaning how much recent data you could lose, and retention should follow your backup retention policy and any legal requirements.
Protected storage. Data is usually compressed, encrypted and sent to storage run by the provider, to cloud storage you own, or to an on-site appliance with a cloud copy. Many services offer immutable storage, which blocks changes and deletion for a set period, or logically isolated copies. Following a pattern like the 3-2-1 backup rule, with more than one copy in more than one place, is still good practice.
Monitoring. Dashboards and alerts show failed jobs and gaps in coverage. Some services also flag unusual change patterns that can indicate ransomware encrypting files.
Restore. You can restore individual files, mailboxes or records, whole servers, or entire environments. Services that include disaster recovery can start your systems on the provider’s infrastructure, which determines how close you can get to your recovery time objective (RTO).
When it matters for buyers
- When backup tools have multiplied. Consolidating onto one service can close gaps and reduce the number of consoles to watch.
- When you rely heavily on SaaS. Microsoft 365, Google Workspace and other SaaS data usually needs its own SaaS backup; providers don’t generally promise to restore what you delete or lose.
- When cyber insurance renews or an audit is due. Insurers and auditors increasingly ask about immutable or offline backups, separate credentials and tested restores.
- When on-site backup hardware reaches end of life. Replacing it is a natural point to compare a service.
- When recovery targets get tighter. If the business needs systems back in hours rather than days, you may need disaster recovery capability, not only backup.
Questions to ask vendors
- Which workloads do you protect natively: servers, virtual machines, endpoints, Microsoft 365, Google Workspace, other SaaS apps, cloud platforms? What is missing or extra?
- Is immutable or isolated storage included, and can an administrator with stolen credentials shorten or remove it?
- Where is our data stored, in which regions, and are any copies made elsewhere?
- How fast can we restore a single mailbox, a whole server and our entire environment, and have you tested those times?
- Is disaster recovery included, or only backup?
- How are storage, retention and restore egress priced as data grows?
- What happens to our backup data, and in what format, if we leave?
How it differs from Backup as a Service (BaaS)
Backup as a service (BaaS) is the narrower, more established term: a provider runs the software and storage that keep restorable copies of your data. DPaaS is a broader marketing label for services that bundle backup with security and governance features such as immutability, anomaly detection, retention and legal hold, and sometimes disaster recovery as a service (DRaaS), which brings whole systems back up on alternate infrastructure. In practice the line is blurry and providers use the terms interchangeably, so judge services on what they include rather than what they are called. Our backup as a service and Microsoft 365 backup pages cover what to compare.
Problems this helps with
- Backups spread across too many tools and nobody sure everything is covered
- Worried ransomware could encrypt or delete our backups too
- Microsoft 365 and other SaaS data isn't backed up the way we assumed
- Auditors and insurers asking us to prove we can restore
