To protect against loss, I use Acronis True Image to backup locally.
I have two physical hard drives. One drive is an SSD partitioned into my C-drive and B-drive; both of these are for software. I have Windows on the C-drive and try to install all non-Windows software on the B-drive. However, some applications insist they must be on a C-drive. The other drive is a spinner partitioned into my E-drive and F-drive. The E-drive is for data. The F-drive is a "recovery drive", which I hope I never have to use.
Once a week on a three-week cycle, I manually do backups. In week #1, I backup all of the C-drive and incrementally backup changes to the E-drive and B-drive. In week #2, I backup all of the B-drive and and incrementally backup changes to the E-drive and C-drive. In week #3, I backup all of the E-drive and and incrementally backup changes to the B-drive and C-drive. I retain all of the current three-week cycle of backups and the prior cycle of backups, deleting the older complete cycle for only one drive when I do a new full backup of that drive, using a disc-eraser application for deletion. The F-drive never changes, so I do not back it up.
I am using less than 20% of the E-drive, so I write all backups to the E-drive. I then use PGP to encrypt the latest backups, both full and incremental. I move the encrypted backups to a portable hard drive, which I store remotely from my PC.
I exclude photos from my weekly backup of my E-drive; I backup the photos separately, only when I have more than a few photos. The backup of photos is copied to the portable hard drive without encryption. I archive software installer files and files of fonts on a flash drive; this I backup directly to the portable hard drive without encryption when there are more than just a few. For both photos and software installers, I follow a four-phase backup (full, incremental, incremental, incremental) instead of a three-phase.
When I delete backups for a "drive" from my E-drive, I also delete the corresponding backups from the portable drive.
By the way, for protecting against malware, I have a anti-virus application always running in the background. Before installing new or updated software or opening an unexpected E-mail attachment, I scan the file with that application and also with two other anti-malware applications. I have Microsoft's software firewall enabled, and I have a hardware firewall in my LAN router. Nevertheless, I fell victim to a virus late in 2014, which required reinstalling Windows 7 and all my applications. Fortunately, my data were untouched; and none were lost.