1. Introduction

Backups and disaster recovery obligations for critical data concern the legal duties of governments, public authorities, businesses, hospitals, biotechnology laboratories, financial institutions, cloud service providers, and other organizations to preserve essential information and restore it when data is lost, corrupted, destroyed, encrypted, or rendered inaccessible.

Critical data may include:

• Personal data: Identity records, medical histories, financial information, and biometric records.
• Government data: Public registers, administrative records, tax information, and emergency-management databases.
• Healthcare data: Electronic health records, diagnostic information, clinical-trial records, and pharmaceutical safety data.
• Scientific and biotechnology data: Genomic datasets, laboratory records, research results, biological sample inventories, and clinical research documentation.
• Financial data: Payment records, transaction histories, accounting records, and banking information.
• Critical infrastructure data: Electricity-grid information, telecommunications records, transportation systems, and industrial control data.
• Commercial data: Intellectual property, manufacturing records, customer databases, and essential operational information.

A backup is a recoverable copy of information maintained separately from the primary system. Disaster recovery refers to the technical, organizational, and operational arrangements used to restore systems and data after a disruptive event.

The central legal question is whether an organization has taken reasonable and legally required measures to ensure that critical data remains available, accurate, confidential, and recoverable.

An important distinction: Backup and disaster recovery duties do not arise from one universal law. They may result from data-protection legislation, cybersecurity regulations, sector-specific rules, contractual commitments, records-retention requirements, professional duties, and judicial decisions.

For an Indian legal analysis, the principal framework includes the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, applicable cybersecurity directions, sector-specific regulations, and relevant judicial precedents. The exact obligations depend on the type of data, the organization involved, the applicable commencement and implementing rules, and any special regulatory requirements.

2. Legal Framework Governing Backups and Disaster Recovery in India

A. Information Technology Act, 2000

The Information Technology Act, 2000 provides an important foundation for cybersecurity, data protection, and liability arising from failures to protect computer resources.

Relevant provisions include:

Section 43 — Unauthorized access, damage, and disruption

Section 43 addresses specified unauthorized or damaging acts involving computer systems and data. Depending on the circumstances, conduct such as unauthorized access, downloading, copying, introducing contaminants, damaging information, or disrupting computer systems may attract liability.

For example, suppose a company maintains its only backup on the same server as its production database. A ransomware attack encrypts both, and the attacker has obtained unauthorized access to the system. Section 43 may be relevant to the attacker's conduct, but the absence of a separate backup does not automatically establish that the company has violated this section.

Section 43A — Compensation for failure to protect data

Section 43A historically provided for compensation where a body corporate handling sensitive personal data or information was negligent in implementing and maintaining reasonable security practices, causing wrongful loss or wrongful gain.

However, the current position requires careful attention to statutory transition. The Digital Personal Data Protection Act, 2023 provides for the omission of Section 43A, but the relevant repeal-and-amendment provision has a phased commencement. As of October 2026, the transition must be assessed against the applicable commencement notification rather than assuming Section 43A has already ceased to operate. India Code

Section 70B — Indian Computer Emergency Response Team

Section 70B establishes the statutory framework for the Indian Computer Emergency Response Team (CERT-In), India's national agency for responding to cybersecurity incidents.

The CERT-In Directions of 28 April 2022 require specified entities, including service providers, intermediaries, data centres, body corporates, and government organizations, to maintain ICT-system logs securely for a rolling period of 180 days within Indian jurisdiction. The Directions also impose applicable cyber-incident reporting and cooperation requirements. CERT-IN

These requirements are important for disaster recovery because incident logs may be necessary to identify the point of compromise, reconstruct events, verify data integrity, and establish whether information was destroyed or altered.

Legal significance: The IT Act and CERT-In framework do not create a universal rule requiring every organization to maintain identical backup frequencies or disaster-recovery facilities. The applicable duties depend on the provision, the entity, the system, and any additional sector-specific requirements.

B. Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 establishes a framework for protecting digital personal data and regulating the responsibilities of Data Fiduciaries.

The Act received presidential assent on 11 August 2023. The commencement notification issued on 13 November 2025 provides for different commencement dates for different provisions. Consequently, the Act must be read together with its commencement notification and the Digital Personal Data Protection Rules, 2025. India Code

The Act is relevant to backups in several ways:

1. Security safeguards: Personal data must be protected in accordance with the applicable statutory requirements.
2. Data accuracy and integrity: Organizations should prevent corruption or unauthorized alteration where accuracy is legally required.
3. Breach management: Data loss or destruction may create security-breach and reporting issues, depending on the circumstances and applicable provisions.
4. Processor accountability: Organizations using cloud providers or other data processors must address relevant responsibilities and safeguards.
5. Retention and deletion: Backup systems must be designed so that preserving information for recovery does not become an excuse for retaining personal data indefinitely.

The Digital Personal Data Protection Rules, 2025

Rule 6 of the Rules addresses reasonable security safeguards. Its requirements include measures to protect personal data, access monitoring, and reasonable measures to ensure continued processing if confidentiality, integrity, or availability is compromised, including through backups.

The Rule also addresses retention of specified logs and personal data for one year for the stated security purposes, subject to the applicable legal requirements. It is important not to confuse this requirement with a universal one-year retention period for every backup copy. IndiaCode by eCourtsIndia

Commencement qualification: Under the notified phased timetable, Rule 6 is scheduled to commence 18 months after publication of the Rules in November 2025—that is, in May 2027. As of October 2026, its substantive requirements should therefore not be treated as already operative merely because the Rules have been notified. Organizations should prepare for implementation while complying with the laws and directions already in force. IndiaCode by eCourtsIndia

C. RBI requirements for regulated financial entities

Financial institutions face particularly demanding continuity and recovery expectations because interruptions can affect payments, customer accounts, financial stability, and regulatory reporting.

The Reserve Bank of India's applicable IT governance and business-continuity requirements address business continuity plans, disaster-recovery policies, restoration testing, backup integrity, and recovery objectives.

For example, the relevant RBI Master Directions for regulated entities specify periodic disaster-recovery testing for critical information systems, including switching to an alternate site and operating it through a full working day. They also address recovery-time objectives, recovery-point objectives, restoration of backed-up data, and coordination with vendors and interconnected systems. The precise instrument and applicability must be checked for the particular class of regulated entity. System Health

These requirements illustrate the difference between merely possessing a backup and maintaining a functioning recovery capability.

A bank might have daily backup files but still fail its continuity obligations if:

• The files cannot be restored.
• The disaster-recovery site is unavailable.
• The recovered database is materially incomplete.
• Security controls and patches differ between the primary and recovery sites.
• Recovery takes longer than the institution's approved objectives.
• A third-party provider's failure prevents restoration.

D. Information Technology Rules and other sector-specific duties

Additional obligations may arise under sector-specific regulations, government security policies, contractual arrangements, and recordkeeping laws.

For example, the Information Technology (Certifying Authorities) Rules, 2000 contain detailed backup and off-site retention provisions for the systems to which those Rules apply. They address documented and monitored backup procedures, separate storage, regular backups, and periodic testing of business recovery plans. These provisions should not be generalized into universal statutory requirements for every Indian business. IndiaCode by eCourtsIndia

Healthcare providers, biotechnology organizations, pharmaceutical manufacturers, and research institutions may also face obligations under applicable professional standards, clinical-trial requirements, licensing conditions, research protocols, and record-retention rules.

The key legal task is to identify which rules apply to the organization and to each category of data it holds.

3. Core Legal Obligations for Backups and Disaster Recovery

3.1 Duty to identify critical data

An organization should determine which information is essential to its legal compliance and continued operation.

A useful data classification system distinguishes:

The organization should document the consequences of losing each category of data.

For example, losing an old marketing database may be inconvenient, while losing a hospital's current medication records may directly endanger patients.

Legal principle: The appropriate level of protection should be proportionate to the sensitivity of the information, the consequences of its loss, the applicable regulatory requirements, and the organization's foreseeable risks.

3.2 Duty to maintain appropriate backups

The organization should maintain backups that are sufficiently current and complete to support its recovery obligations.

A legally defensible backup arrangement commonly includes:

• Scheduled backups appropriate to the system's importance.
• Separate storage from the production environment.
• Offline or immutable copies where ransomware or malicious deletion is a material risk.
• Encryption and access controls.
• Protection against unauthorized alteration.
• Monitoring of backup failures.
• Documented retention periods.
• Preservation of essential configurations and system dependencies.
• Periodic restoration tests.

These are general risk-management practices, not a claim that every item is expressly mandated for every organization by Indian law.

The legal issue is whether the measures satisfy the applicable statutory, regulatory, contractual, and professional requirements.

3.3 Duty to establish a disaster-recovery plan

A disaster-recovery plan should explain how the organization will restore critical systems following a serious incident.

It should identify:

1. Who has authority to declare a disaster.
2. Which systems must be restored first.
3. Where recoverable copies are stored.
4. How the organization will verify backup integrity.
5. How operations will continue during restoration.
6. How data created after the last successful backup will be reconciled.
7. How affected users, regulators, and business partners will be notified where required.
8. How the organization will return to normal operations safely.

A plan that exists only as an untested document may be inadequate evidence of effective preparedness when applicable law or regulation requires functioning continuity arrangements.

3.4 Recovery-time objective and recovery-point objective

Two technical concepts have particular legal significance.

Recovery-Time Objective (RTO) is the target time within which a system or service should be restored after disruption.

Recovery-Point Objective (RPO) is the maximum targeted period of data loss measured backward from the disruption.

Consider a payment-processing platform:

• RTO: two hours.
• RPO: five minutes.

These targets mean that the organization aims to restore the service within two hours and limit data loss to approximately five minutes of transactions.

They are illustrative targets, not universal statutory limits.

If a regulated organization has adopted specific recovery targets under applicable RBI requirements, contracts, or approved internal policies, failing to meet those targets may have regulatory or contractual consequences.

For a hospital, the correct targets may differ between patient monitoring, medication administration, appointment scheduling, and archival research records.

3.5 Duty to test restoration

A successful backup job does not prove that the data can be recovered.

A backup may be incomplete, encrypted by an attacker, corrupted, dependent on unavailable software, or inaccessible because credentials have been lost.

Organizations should therefore conduct documented restoration tests, verify data integrity, measure recovery time, and correct identified weaknesses.

For regulated financial entities, RBI requirements expressly address disaster-recovery testing and the restoration of backed-up data. System Health

3.6 Duty to preserve evidence

Disaster recovery must be distinguished from the preservation of evidence.

Suppose a company suffers a ransomware attack after receiving notice of pending litigation. Restoring its systems from backup may be necessary for business continuity, but deleting the compromised systems' logs or overwriting relevant records could undermine an investigation or legal proceeding.

The organization should preserve relevant:

• Security logs.
• Backup histories.
• System snapshots.
• Incident-response records.
• Restoration reports.
• Access records.
• Communications with service providers.
• Records of decisions made during the incident.

Applicable retention periods and legal holds must be considered separately from ordinary backup rotation schedules.

4. Important Case Laws and Their Legal Significance

A crucial point must be understood before examining the cases: there is no need to establish a universal judicial rule requiring every organization to maintain a particular number of backups. Indian courts have developed relevant principles concerning privacy, cybersecurity, electronic evidence, authenticity, and preservation. These principles help determine how backup failures may be evaluated in particular disputes.

Case 1: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

Citation: (2017) 10 SCC 1
Court: Supreme Court of India
Subject: Constitutional right to privacy.

Facts and legal issue

The case concerned whether privacy is protected as a fundamental right under the Constitution of India.

A nine-judge bench recognized privacy as a constitutionally protected right, grounded in liberty, dignity, and personal autonomy, including under Article 21.

Judgment

The Court affirmed that privacy is a fundamental right and that restrictions affecting privacy must satisfy applicable constitutional requirements.

The judgment provides a constitutional foundation for the protection of personal information.

Relevance to backups and disaster recovery

Consider a hospital that stores patient records in a cloud backup system. The backup provider suffers a security breach, exposing medical histories and genetic information.

The constitutional principles established in Puttaswamy help explain why personal information must be protected against inappropriate access and disclosure.

However, the judgment does not itself prescribe a backup schedule or establish an independent disaster-recovery obligation for every private organization.

Its relevance lies in the broader constitutional importance of informational privacy and the protection of personal data.

Legal principle: Data protection must respect individual privacy and dignity. Backup systems should therefore be designed to support availability without creating unnecessary exposure of personal information. Sci API

Case 2: Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

Citation: (2020) 7 SCC 1
Court: Supreme Court of India
Subject: Admissibility and authenticity of electronic evidence.

Facts and legal issue

The dispute concerned the requirements for admitting electronic records as evidence, including the certification requirements under Section 65B of the Indian Evidence Act, 1872, as it applied at the time.

The Court examined the relationship between electronic records, copies of electronic records, and the statutory requirements for proving them in legal proceedings.

Judgment

The Supreme Court reaffirmed the importance of complying with the applicable statutory requirements for proving electronic evidence.

It emphasized the need to establish the source and authenticity of electronic records and explained the requirements governing certificates for computer-generated copies.

The Court also discussed the need for appropriate rules concerning preservation, retrieval, production, chain of custody, and metadata relating to electronic records.

Relevance to backups and disaster recovery

Suppose a company loses its original transaction database after a server failure. It seeks to establish its contractual rights using records recovered from a backup.

The recovered records may be highly valuable, but the organization must still establish their authenticity and satisfy the applicable evidentiary requirements.

A responsible recovery process should preserve:

• The source of the recovered information.
• The identity and integrity of the backup.
• The date and method of restoration.
• Relevant metadata and audit logs.
• Records of access and handling.
• Applicable electronic-record certificates and other evidentiary requirements.

The judgment does not hold that every organization must maintain backups. Instead, it demonstrates why reliable preservation and retrieval mechanisms can be important when electronic records must be proved in court.

Legal principle: Recoverable data must also be capable of being authenticated and lawfully produced as evidence. Sci API

Case 3: Anvar P.V. v. P.K. Basheer (2014)

Citation: (2014) 10 SCC 473
Court: Supreme Court of India
Subject: Proof of electronic records.

Facts and legal issue

The case concerned the admissibility of electronic evidence and the statutory requirements for proving electronic records under the Indian Evidence Act, 1872.

Judgment

The Supreme Court established that secondary electronic evidence was subject to the applicable requirements of Section 65B.

The judgment emphasized the need for safeguards that establish the authenticity and reliability of electronic records.

Its evidentiary approach was subsequently clarified and reaffirmed by the larger bench in Arjun Panditrao Khotkar.

Relevance to backup obligations

A backup is often a copy of information originally stored on another device or system. Where the backup is used as evidence, questions may arise about how the copy was created, whether it was altered, and whether the applicable legal requirements for admission have been satisfied.

For example, a research laboratory may restore its experimental records after a database failure. If those records are later used in patent litigation, the laboratory may need to demonstrate that they accurately represent the original records.

The relevant legal duties concern evidentiary reliability and compliance with applicable law, rather than a universal statutory requirement to back up every electronic record.

Legal principle: Preserving an electronic copy does not automatically establish its authenticity or admissibility. Indian Kanoon

Case 4: Tomaso Bruno v. State of Uttar Pradesh (2015)

Citation: (2015) 7 SCC 178
Court: Supreme Court of India
Subject: Scientific and electronic evidence.

Legal significance

The Supreme Court discussed the importance of scientific and electronic evidence in criminal investigations and judicial proceedings.

The case is relevant to the evidentiary consequences of failing to preserve or produce potentially important electronic material.

Application to disaster recovery

Consider a business that experiences a cyberattack and loses the security footage and access logs needed to investigate unauthorized entry into its systems.

If relevant records are not preserved, investigators or litigants may face difficulties reconstructing events.

A disaster-recovery plan should therefore distinguish between restoring business operations and preserving information that may be required for an investigation.

The legal consequences of missing evidence depend on the facts, the applicable procedural rules, the party responsible for the loss, and whether the material should reasonably have been preserved.

Legal principle: Reliable electronic evidence can be important to establishing facts and accountability. Organizations should consider evidence preservation as part of their incident-response and recovery procedures. WBJA

Case 5: Justice K.S. Puttaswamy and Arjun Panditrao read together

These judgments address different legal issues, but together they illustrate an important distinction.

These are applications of the judgments' broader principles, not findings that either case imposed a comprehensive backup regime on all organizations.

5. International Case Law and Comparative Legal Principles

International decisions may help explain how courts approach data protection, cybersecurity risk, and organizational responsibility. Their legal authority in India depends on the context; foreign judgments do not automatically bind Indian courts.

A. Lloyd v. Google LLC (2021)

Citation: [2021] UKSC 50
Court: Supreme Court of the United Kingdom
Subject: Data protection and compensation.

The case concerned a representative action alleging that Google had unlawfully collected and used personal information relating to iPhone users.

The UK Supreme Court rejected the proposed representative claim in the form presented, holding that compensation under the relevant data-protection legislation could not simply be awarded on a uniform basis without establishing the necessary individual damage or distress.

Relevance: A data-protection failure does not automatically establish every element of a compensation claim. The applicable statute, the nature of the infringement, causation, and the relevant loss must be considered.

For backup failures, this supports a careful distinction between a technical failure, a statutory breach, and a legally compensable injury.

B. Google Spain SL v. Agencia Española de Protección de Datos (2014)

Citation: Case C-131/12
Court: Court of Justice of the European Union
Subject: Personal data and data-protection rights.

The Court examined the application of European data-protection law to search-engine processing and the rights of individuals concerning information about them.

Relevance: Backup and recovery systems must be considered alongside the broader legal requirements governing personal data.

Retaining copies for recovery purposes does not automatically justify indefinite retention or unrestricted use. Organizations must distinguish legitimate continuity needs from unrelated or excessive data retention.

The judgment did not concern backup architecture directly, but it illustrates the importance of evaluating the full lifecycle of personal data.

C. Google LLC v. CNIL (2019)

Citation: Case C-507/17
Court: Court of Justice of the European Union
Subject: Territorial scope of data-protection obligations.

The Court considered the territorial scope of de-referencing obligations under European data-protection law.

Relevance: Organizations operating across jurisdictions may face different requirements concerning data access, storage, retention, and deletion.

A multinational organization's backup architecture should therefore account for applicable territorial restrictions and legal obligations rather than assuming that all copies may be stored or processed in any location.

Again, this is a comparative lesson, not a direct judicial rule prescribing disaster-recovery arrangements.

6. Legal Liability for Backup and Disaster-Recovery Failures

A backup failure can lead to different forms of liability, depending on the facts.

6.1 Regulatory liability

An organization may face regulatory action if it fails to comply with a binding cybersecurity, data-protection, financial-sector, or other applicable requirement.

For example, a regulated financial institution may be unable to restore a critical payment system within its required recovery objectives.

The regulator may examine whether the institution complied with the applicable continuity requirements, tested its recovery systems, managed vendor risks, and responded appropriately to the incident.

The mere occurrence of a disaster does not necessarily prove a legal violation. The inquiry concerns the duties that applied and the organization's conduct.

6.2 Contractual liability

Cloud contracts and service-level agreements may contain express commitments relating to:

• Backup frequency.
• Data retention.
• Recovery-time targets.
• Recovery-point targets.
• Availability guarantees.
• Geographic storage.
• Security controls.
• Incident notification.
• Data export and restoration.
• Termination assistance.

If a provider fails to meet a binding commitment and the failure causes legally recoverable loss, contractual liability may arise, subject to the contract's terms and applicable law.

Example: A cloud provider promises daily backups but fails to create them for several weeks. A hardware failure then destroys the only available copy of a customer's database.

The customer may have a contractual claim if the provider breached its obligations and the requirements for liability are satisfied.

The result may differ if the contract clearly allocates responsibility for customer-managed backups or limits the provider's restoration obligations.

6.3 Negligence and civil liability

A business may face a negligence claim if it owed a relevant duty of care, breached that duty, and caused legally recognized loss.

A claimant may argue that the organization failed to take reasonable precautions, ignored known vulnerabilities, or operated without a suitable recovery plan.

However, a missing backup does not automatically establish negligence in every case. The applicable standard of care, foreseeability, causation, and the nature of the loss must be established.

6.4 Privacy and data-protection liability

A disaster can affect both the availability and confidentiality of personal information.

For example:

• Data may be destroyed, preventing legitimate access.
• A backup may be stolen, exposing personal information.
• A compromised recovery site may permit unauthorized access.
• Restored data may contain inaccurate or outdated information.
• Data intended for deletion may remain in backups beyond a legally permitted period.

These situations raise different legal questions. A recovery solution that restores availability but exposes confidential information may solve one problem while creating another.

6.5 Evidentiary consequences

The loss of electronic records may affect a party's ability to prove its case.

For example, a company may be unable to establish the timing of a transaction because its records were lost and its remaining backups are unreliable.

The court will assess the evidence under the applicable procedural and evidentiary rules. The loss of records does not automatically determine the outcome of the litigation.

7. Application to Hospitals, Biotechnology Laboratories, and Critical Research Data

Backups and disaster recovery are particularly important where information loss can affect human safety, research integrity, or regulatory compliance.

A. Hospitals

A hospital should assess the recovery needs of electronic health records, medication systems, diagnostic information, laboratory systems, and patient-monitoring infrastructure.

If critical information becomes unavailable, clinicians may lack information needed for safe treatment.

A hospital's legal exposure depends on the applicable healthcare, privacy, professional, contractual, and recordkeeping obligations.

A sensible recovery plan should prioritize systems according to patient-safety risk, provide controlled access to recovered records, and establish procedures for reconciling records created during downtime.

B. Biotechnology laboratories

A biotechnology laboratory may maintain:

• Genomic sequencing results.
• Laboratory information management system records.
• Clinical-trial datasets.
• Experimental protocols.
• Biological sample inventories.
• Equipment calibration records.
• Research approvals and consent documentation.

Losing this information may affect reproducibility, research integrity, regulatory submissions, and the ability to establish what occurred during an experiment.

For example, if a laboratory loses its only copy of the raw sequencing data used in a regulatory submission, a recovered summary report may not be sufficient to reconstruct the analysis.

The appropriate backup and retention arrangements depend on the applicable research, clinical-trial, licensing, and data-protection requirements.

C. Critical infrastructure operators

Electricity, telecommunications, transportation, and industrial operators may rely on operational data necessary to restore services safely.

A recovery plan must account for both information restoration and the safe re-establishment of operational control.

Simply copying a database to another site may be insufficient if the recovery environment lacks compatible configurations, validated software, reliable communications, or appropriate access controls.

For these operators, backup arrangements should be integrated with business continuity, operational safety, incident response, and supplier-risk management.

8. The Relationship Between Backup, Retention, and Deletion

One of the most difficult legal issues is balancing recoverability against the obligation not to retain data unnecessarily.

A backup system may contain information that has been deleted from the live database. Whether the continued presence of that information is lawful depends on the applicable retention and deletion requirements and the system's actual operation.

A well-designed policy should address:

1. The purpose of each backup.
2. The categories of information included.
3. The applicable retention period.
4. How deletion requests are handled in backup systems.
5. How deleted data is prevented from reappearing during restoration.
6. How legal holds override routine deletion where required.
7. How backup copies are securely destroyed when retention is no longer justified.

For example, a company may delete a customer's information from its production database but later restore an older backup containing the same information.

The organization should have procedures to reconcile the restored database with valid deletion records, subject to any lawful retention obligation.

This is particularly important under data-protection regimes that impose storage-limitation or deletion requirements.

The central principle is that backups are not exempt from applicable data-protection law merely because they exist for technical recovery purposes.

9. Recommended Compliance Framework

Organizations seeking to demonstrate reasonable preparedness should establish a documented framework covering the following areas.

Illustrative example

Suppose an Indian biotechnology company stores clinical-trial records in a cloud platform. A ransomware attack corrupts its primary database.

The company's legal and operational response should include:

Step 1: Containment. Isolate affected systems and prevent the attack from spreading to backups.

Step 2: Evidence preservation. Preserve relevant logs, incident records, and potentially relevant electronic evidence.

Step 3: Regulatory assessment. Determine whether the incident triggers reporting or other duties under applicable cybersecurity, data-protection, clinical-trial, or contractual requirements.

Step 4: Recovery. Restore records from a verified recovery copy in a controlled environment.

Step 5: Validation. Check completeness, integrity, timestamps, and consistency against independent records.

Step 6: Reconciliation. Identify missing or altered records created after the last successful backup.

Step 7: Resumption. Resume critical operations only when the recovered systems are sufficiently secure and reliable.

Step 8: Remediation. Correct the weakness that allowed the incident to affect both the production environment and recovery arrangements.

Step 9: Documentation. Preserve the recovery timeline, decisions, test results, and corrective actions.

This approach helps demonstrate that the organization treated continuity, security, evidence preservation, and regulatory compliance as connected responsibilities.

10. Conclusion

Backups and disaster recovery are no longer merely technical conveniences. They are important components of legal compliance, operational resilience, information security, and organizational accountability.

In India, the legal position is shaped by the Information Technology Act, 2000, applicable CERT-In Directions, the phased implementation of the Digital Personal Data Protection Act, 2023 and its Rules, sector-specific regulatory requirements, contracts, and relevant judicial principles.

The most important cases discussed above establish complementary principles:

• Justice K.S. Puttaswamy v. Union of India recognizes the constitutional importance of privacy and personal autonomy.
• Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal explains the legal requirements for proving electronic records and highlights the importance of authenticity and preservation.
• Anvar P.V. v. P.K. Basheer establishes important principles governing the admissibility of secondary electronic evidence.
• Tomaso Bruno v. State of Uttar Pradesh illustrates the importance of electronic and scientific evidence in judicial proceedings.

These decisions do not establish a universal backup frequency or require every organization to maintain a particular disaster-recovery architecture. Their relevance lies in the broader legal principles that inform data protection, evidentiary reliability, and accountability.

The ultimate legal standard is context-dependent: an organization should identify the duties applicable to its data and operations, implement proportionate and effective recovery measures, test those measures where required, preserve relevant evidence, and demonstrate that it has acted in accordance with applicable law.

A backup that cannot be restored may fail its operational purpose. A restored record that cannot be authenticated may fail its evidentiary purpose. And a technically successful recovery that violates privacy or retention requirements may create additional legal exposure.

Effective compliance therefore requires more than storing copies of data: it requires a legally informed, secure, tested, and accountable system for preserving and restoring critical information.