Redundancy requirements for critical datasets

Introduction

Redundancy requirements for critical datasets refer to the technical, organisational and legal measures adopted to maintain multiple copies of essential digital information so that data remain available, accurate and recoverable despite system failures, cyberattacks, accidental deletion, hardware damage or natural disasters. Data redundancy is an important component of information security, business continuity, disaster recovery and regulatory compliance.

In biotechnology, healthcare, pharmaceutical research, genetic engineering and clinical trials, critical datasets include patient medical records, genomic information, clinical trial results, laboratory observations, biological sample inventories and pharmaceutical manufacturing records. The loss or corruption of such information may affect patient safety, scientific research, regulatory approvals and institutional accountability.

Redundancy systems therefore ensure that essential information is preserved through secure backups, geographically separated storage facilities, replicated databases and disaster recovery mechanisms. However, redundancy must be implemented carefully because maintaining multiple copies of personal and confidential information can also increase privacy and cybersecurity risks.

Meaning and objectives of data redundancy

Data redundancy refers to maintaining additional copies of information across different storage systems or locations to prevent permanent data loss and ensure uninterrupted access.

The major objectives include:

Data availability: Ensuring that essential information remains accessible during system failures.

Disaster recovery: Restoring critical datasets after cyberattacks, natural disasters or infrastructure failures.

Data integrity: Protecting information against unauthorised modification, corruption and accidental deletion.

Regulatory compliance: Meeting applicable requirements concerning preservation of records and research documentation.

Business continuity: Allowing healthcare institutions and biotechnology organisations to continue essential operations.

Scientific reliability: Preserving research datasets necessary for verification, reproducibility and future scientific investigations.

Types of redundancy systems

1. Backup redundancy

Backup redundancy involves creating additional copies of important datasets and storing them separately from the primary operational system. Backups may be full, incremental or differential.

2. Geographic redundancy

Geographic redundancy involves storing copies of critical information in physically separate locations. This protects datasets against localised disasters, infrastructure failures and regional disruptions.

3. Database replication

Database replication involves maintaining copies of databases across multiple servers. Changes made to the primary database are transferred to secondary systems according to the replication arrangement.

4. Storage redundancy

Storage redundancy uses technologies such as RAID (Redundant Array of Independent Disks) to protect against certain hardware failures. However, RAID alone is not a substitute for independent backups.

5. Cloud redundancy

Cloud redundancy involves storing data across multiple availability zones or geographically separated facilities. It can improve availability and recovery capabilities when properly configured.

6. Immutable backups

Immutable backups are protected against modification or deletion during a specified retention period. They are particularly useful for defending critical datasets against ransomware and malicious insider activity.

Legal framework governing redundancy requirements in India

1. Information Technology Act, 2000

The Information Technology Act, 2000 provides an important legal framework for electronic records, cybersecurity and information security.

Section 43 addresses unauthorised access, copying, extraction and specified forms of damage involving computer systems and data.

Section 43A historically addressed compensation for failure to protect sensitive personal data or information through reasonable security practices. Its current applicability must be assessed in light of the Digital Personal Data Protection Act, 2023 and the relevant commencement and repeal provisions.

Section 70B establishes the Indian Computer Emergency Response Team (CERT-In) as the national agency for incident response.

These provisions are relevant to organisations maintaining critical datasets and implementing security and recovery arrangements.

2. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes obligations concerning the protection of digital personal data.

Section 8 places responsibilities on Data Fiduciaries, including taking reasonable security safeguards to prevent personal data breaches.

Redundancy systems involving personal data must therefore be designed with appropriate access controls, encryption and security protections. Maintaining additional copies should not create unnecessary exposure or violate applicable retention requirements.

3. Companies Act, 2013

Section 128 requires companies to maintain proper books of account and relevant supporting records.

The provision supports the need for reliable information preservation and accessible accounting records. Companies must maintain appropriate systems to prevent the loss or destruction of legally required records.

4. Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011

These rules establish requirements concerning the protection of sensitive personal data or information under their applicable statutory framework.

Rule 8 addresses reasonable security practices and procedures. It recognises the importance of documented security programmes and internationally accepted information security standards.

5. CERT-In Directions, 2022

CERT-In issued directions under Section 70B of the Information Technology Act, 2000 concerning cybersecurity incident reporting, log retention and other specified security requirements.

Organisations covered by these directions must maintain relevant ICT system logs securely for the prescribed period. Such requirements are particularly important for institutions operating critical digital infrastructure.

Essential redundancy requirements for critical datasets

1. Backup frequency and scheduling

Organisations should establish backup schedules according to the importance and rate of change of their datasets.

For example, hospital patient records and clinical trial databases may require frequent backups, whereas certain archived research datasets may require less frequent operational replication.

2. Geographic separation

Critical backups should be stored separately from primary infrastructure to reduce the risk of simultaneous destruction.

3. Encryption and access management

Backup copies should be protected through encryption, authentication and restricted access. Only authorised personnel should be permitted to retrieve or modify protected datasets.

4. Regular restoration testing

Creating backups is insufficient unless organisations regularly verify that the stored information can actually be recovered.

Restoration tests help identify corrupted files, incomplete backups and configuration failures.

5. Data integrity verification

Cryptographic checksums and integrity verification procedures can help detect unauthorised changes or corruption in stored datasets.

6. Disaster recovery planning

Institutions should establish documented recovery procedures, including recovery time objectives (RTO) and recovery point objectives (RPO).

RTO specifies the targeted time within which a system should be restored.

RPO specifies the maximum acceptable period of data loss measured in time.

7. Retention and secure deletion

Redundant copies must follow applicable retention requirements. When information is no longer required and deletion is legally appropriate, organisations should ensure that obsolete copies are also securely removed.

Importance in biotechnology and healthcare

Redundancy requirements have particular significance in biotechnology because research institutions generate large volumes of complex and irreplaceable scientific information.

For example, a genomic research laboratory may maintain sequencing datasets, patient consent records, analytical outputs and experimental observations. If these records are lost, researchers may be unable to reproduce experiments or verify scientific conclusions.

Similarly, pharmaceutical manufacturers must preserve batch manufacturing records, quality-control reports and stability-testing information. Hospitals must maintain reliable access to patient records to support continuity of healthcare services.

Therefore, redundancy systems protect both scientific knowledge and essential healthcare information.

Important case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 and other constitutional provisions.

The judgment established the importance of informational privacy and individual control over personal information.

It is relevant to data redundancy because maintaining multiple copies of patient records, genomic information and other personal datasets creates additional privacy and security responsibilities. Organisations must ensure that backup arrangements do not result in unnecessary exposure of confidential information.

2. Shreya Singhal v. Union of India (2015)

The Supreme Court examined the constitutional validity of Section 66A of the Information Technology Act, 2000 and recognised the importance of protecting freedom of expression in the digital environment.

Although the case did not directly concern backup systems, it is relevant to digital governance because it demonstrates that technological and regulatory measures must operate within constitutional limits.

3. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court examined privacy concerns relating to access to confidential financial records.

The judgment recognised the importance of protecting confidential information from unjustified access.

Its principles are relevant to critical dataset redundancy because additional stored copies of financial, medical and scientific information must remain subject to appropriate confidentiality safeguards.

4. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under the Indian Evidence Act, 1872.

The Court emphasised compliance with the statutory requirements governing electronic evidence and the importance of proper certification under Section 65B in applicable circumstances.

The judgment is relevant to critical dataset management because preserving electronic records in a reliable and verifiable manner can be essential when digital information is required as evidence.

5. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements concerning admissibility of electronic records and the certificate prescribed under Section 65B of the Indian Evidence Act, 1872.

The judgment reinforced the importance of maintaining reliable electronic records and complying with evidentiary requirements.

For biotechnology and healthcare institutions, this principle is relevant when backup datasets contain electronic records that may subsequently be relied upon in regulatory investigations or legal proceedings.

Challenges in implementing redundancy requirements

Several challenges affect the implementation of effective redundancy systems.

High infrastructure costs: Maintaining multiple storage environments and geographically separated backups may require substantial investment.

Cybersecurity threats: Poorly protected backups may become targets of ransomware and unauthorised access.

Data inconsistency: Improper replication procedures may create conflicting versions of critical datasets.

Privacy concerns: Multiple copies of personal and medical information increase the importance of access restrictions and security controls.

Regulatory retention: Different categories of records may be subject to different preservation and deletion requirements.

Recovery failures: Backups may remain unusable because of corruption, incomplete replication or outdated recovery procedures.

To address these challenges, organisations should implement documented backup policies, independent recovery testing, encryption, role-based access controls and periodic cybersecurity assessments.

Conclusion

Redundancy requirements for critical datasets are essential for ensuring data availability, integrity, continuity and regulatory accountability. They protect valuable information against hardware failures, cyberattacks, accidental deletion and other unexpected disruptions.

In India, the Information Technology Act, 2000, Digital Personal Data Protection Act, 2023, Companies Act, 2013 and applicable CERT-In directions provide important legal foundations for information security and record preservation.

Judicial decisions such as K.S. Puttaswamy v. Union of India, District Registrar v. Canara Bank and Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal establish important principles concerning informational privacy, confidentiality and electronic record reliability.

Ultimately, effective redundancy management requires secure backups, geographic separation, regular recovery testing, appropriate retention policies and strong cybersecurity safeguards. It ensures that critical scientific, healthcare and commercial information remains protected and available when required.