Secured hosting is a big deal. To focus only on the backup aspects of hosting is somewhat dangerous to you as a merchant. It is also important to focus on the security of your data.

Make sure you are hosting with a PCI/CISP certified hosting company. Being PCI/CISP certified means that auditors from Visa and MasterCard have actually approved your hosting environment is secure and that credit card data is safe from internet hackers. A simple hard drive in your home or office is probably not the safest route to protect yourself. If this drive gets compromised, you could be out of business.

In terms of backups, it is good to host backups in an off site facility that is secured and backed up nightly.

When you consider the ramifications of having credit card data stolen (being blackballed by credit card companies, fines, etc.), secured hosting really is the only way to go.