{"id":14167,"date":"2025-03-20T11:08:08","date_gmt":"2025-03-20T10:08:08","guid":{"rendered":"https:\/\/www.sciencepharma.com\/blog\/backup-regulatory-requirements-best-practices\/"},"modified":"2025-03-27T14:12:59","modified_gmt":"2025-03-27T13:12:59","slug":"backup-regulatory-requirements-best-practices","status":"publish","type":"blog","link":"https:\/\/www.sciencepharma.com\/zh-hans\/blog\/backup-regulatory-requirements-best-practices\/","title":{"rendered":"World Backup Day \u2013 Regulatory Requirements and Best Practices"},"content":{"rendered":"

On March 31st<\/span><\/strong>, we celebrate World Backup Day<\/strong>. It\u2019s a perfect opportunity to remind you about one of the key issues in data security<\/strong>, particularly in the pharmaceutical industry<\/strong>. With the ongoing digital transformation that enables more effective management of documentation and processes, data protection becomes a crucial element in ensuring regulatory compliance and business continuity. <\/span><\/p>\n\n\n

<\/div>\n\n\n\n

Why does your company need backups?<\/strong><\/h2>\n\n\n

Compliance with regulatory requirements, ensuring business continuity, minimising risks, and protecting data from loss are fundamental to the operation of any organisation subject to the requirements of regulators such as manufacturers, importers or MAHs (Marketing Authorisation Holders).<\/p>\n

Data backup requirements are defined in regulations such as Annex 11<\/strong> to GMP, which governs data’s physical and electronic protection against destruction. Additionally, data should be checked for accessibility, readability, and accuracy, and access should be properly monitored. GMP requirements also mandate regular backups<\/strong> and data recovery tests<\/strong> [1].<\/p>\n

Similar provisions can be found in Good Pharmacovigilance Practice<\/strong> (GVP), which states that documents may be stored in electronic format, provided that the electronic system has been properly approved and adequate arrangements are made for system security, access, and data backup [2].<\/p>\n

Furthermore, the ICH Q7 guidelines<\/strong> for the Good Manufacturing Practice<\/strong> for Active Pharmaceutical Ingredients<\/strong> emphasise the need for backup procedures for systems where failure could lead to permanent data loss [3].<\/p>\n

The Good Distribution Practice<\/strong> (GDP) requirements also outline the necessity of performing regular backups, checking the availability of stored data, and maintaining backup copies for a minimum of 5 years in a separate secure location [4].<\/p>\n\n\n

<\/div>\n\n\n\n

Who in your company is responsible for performing backups?<\/strong><\/h2>\n\n\n

In pharmaceutical systems, the responsibility for performing data backups is not clearly assigned to one individual or department but depends on <\/strong>the system’s characteristics<\/strong> and the organisation\u2019s structure<\/strong>.
Due to the growing popularity and security of solutions for computerised systems, the cloud system model is becoming increasingly widespread. As a result, issues related to third-party service providers are becoming extremely important. For systems with servers and infrastructure managed by external providers, the responsibility for performing backups primarily lies with the service provider. In the case of SaaS<\/strong> (Software as a Service) systems<\/strong>, the provider’s qualification becomes a key issue. According to Annex 11 GMP requirements<\/strong>, the organisation must conduct a supplier evaluation process. Furthermore, the agreement with the service provider (SLA) should specify the scope of responsibility, including backup creation and data recovery procedures, in case of failure. The agreement should also outline the frequency of backups<\/strong>, the location of backup storage<\/strong>, and the security of stored data<\/strong> [1].<\/p>\n

Meanwhile, the Quality Assurance Department plays a key role in verifying that backup processes (internally and through the system provider) are carried out in accordance with organisational and regulatory requirements.<\/p>\n\n\n

<\/div>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

When should your company perform backups?<\/strong><\/h2>\n\n\n

Data archiving and recovery tests should be an integral part of validating computerised systems [1]. During the system lifecycle, the frequency of backups and the processes for testing their integrity and recovery must be carefully planned, taking into account:<\/p>\n