Data backup frequency and retention policies

Introduction

Data backup frequency and retention policies refer to the legal, technical, and organizational rules governing how frequently digital information must be copied, stored, protected, and preserved for future use. These policies are essential for organizations handling sensitive information, including biotechnology companies, pharmaceutical laboratories, hospitals, research institutions, and clinical trial organizations.

Such institutions maintain important records relating to genetic research, patient histories, laboratory experiments, clinical trials, pharmaceutical manufacturing, and regulatory approvals. Data loss caused by cyberattacks, hardware failures, accidental deletion, or natural disasters can disrupt research activities and create legal complications.

Backup policies ensure that information can be recovered, while retention policies determine how long records must be maintained before lawful deletion or archival. Together, they promote data security, business continuity, regulatory compliance, and institutional accountability.

Legal framework governing data backup and retention

1. Information Technology Act, 2000

The Information Technology Act, 2000, provides the legal foundation for electronic records and cybersecurity in India. Section 43 addresses unauthorized access, downloading, copying, and damage to computer information. Section 66 provides criminal punishment for specified acts committed dishonestly or fraudulently.

Section 70B establishes CERT-In as the national cybersecurity incident-response agency.

CERT-In's directions dated 28 April 2022 require specified entities to maintain ICT system logs securely for a rolling period of 180 days within Indian jurisdiction. This is a specific log-retention requirement, not a universal backup-retention period.

2. Digital Personal Data Protection Act, 2023

The Act establishes obligations concerning the processing and protection of digital personal data.

Section 8 addresses the general obligations of Data Fiduciaries, including reasonable security safeguards and erasure of personal data when its purpose is no longer served, subject to applicable legal retention requirements.

Organizations must therefore balance backup preservation with applicable data-erasure obligations.

3. Companies Act, 2013

Section 128 requires companies to maintain proper books of account and relevant financial records for at least eight financial years immediately preceding the current financial year, subject to applicable exceptions.

Section 128(5) also addresses preservation of books of account and related papers.

These requirements are important for pharmaceutical and biotechnology companies maintaining financial, procurement, and operational records.

4. GST legislation

Section 36 of the Central Goods and Services Tax Act, 2017, generally requires relevant accounts and records to be retained for 72 months from the due date of furnishing the annual return for the relevant year.

Where proceedings are pending, records must be retained for the additional period prescribed by law.

Importance of backup frequency and retention policies

Organizations must determine backup frequency according to the importance and changing nature of their information.

Important objectives include:

Preventing permanent loss of scientific and commercial information.

Maintaining clinical trial and patient records.

Supporting regulatory inspections and investigations.

Protecting against ransomware and cyberattacks.

Ensuring business continuity.

Maintaining reliable electronic evidence.

Meeting statutory and contractual retention obligations.

Types of data backup

1. Full backup

A full backup creates a complete copy of selected organizational information. It provides comprehensive recovery but requires greater storage capacity and time.

2. Incremental backup

Incremental backup stores changes made since the previous backup. It reduces storage requirements and allows frequent backup operations.

3. Differential backup

Differential backup stores changes made since the last full backup. It can simplify recovery compared with a long sequence of incremental backups.

4. Cloud backup

Cloud backup stores copies of organizational information on remote infrastructure. It supports disaster recovery but requires appropriate encryption, access controls, and vendor security arrangements.

Backup frequency and retention standards

Organizations should establish backup schedules based on their operational requirements and acceptable data-loss risks.

For example:

These are recommended operational practices, not universal statutory frequencies.

The ISO/IEC 27001 information security management standard and ISO 22301 business continuity standard provide useful guidance for establishing appropriate backup and recovery arrangements.

Important judicial decisions and case laws

1. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognized privacy as a fundamental right under Article 21 of the Constitution.

Relevance: Organizations must protect personal information stored in backups and ensure that retaining data does not unnecessarily interfere with individual privacy.

2. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under the Indian Evidence Act, 1872.

The judgment emphasized compliance with statutory requirements for proving electronic evidence.

Relevance: Properly maintained backups can help preserve electronic records and support their production during legal proceedings. However, a backup alone does not automatically establish admissibility.

3. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements concerning certification of electronic records under Section 65B of the Indian Evidence Act.

Relevance: Organizations must maintain reliable electronic records, appropriate system documentation, and supporting certification procedures when producing digital evidence. The current evidentiary framework is governed by the Bharatiya Sakshya Adhiniyam, 2023.

4. Shreya Singhal v. Union of India (2015)

The Supreme Court struck down Section 66A of the Information Technology Act for violating Article 19(1)(a).

Relevance: Data preservation and retention practices must operate within constitutional safeguards and applicable privacy protections.

Challenges in implementing retention policies

Organizations face several difficulties when designing backup and retention systems:

Storage costs: Maintaining multiple backup copies requires significant infrastructure.

Cybersecurity threats: Backups may also become targets of ransomware and unauthorized access.

Regulatory complexity: Different categories of records may have different statutory retention periods.

Data privacy: Excessive retention may create unnecessary privacy risks.

Disaster recovery: Inadequate backup testing may prevent successful restoration.

Cross-border storage: International cloud storage may create additional legal and regulatory obligations.

Recommendations and conclusion

Organizations should adopt written backup and retention policies identifying responsible personnel, backup frequency, storage locations, security controls, recovery procedures, and deletion schedules.

Important measures include regular backup testing, encrypted storage, geographically separate copies, restricted access, immutable backups, and periodic retention reviews.

In India, the Information Technology Act, 2000, Digital Personal Data Protection Act, 2023, Companies Act, 2013, and GST legislation establish important legal requirements concerning cybersecurity, personal data protection, and record preservation.

Judicial decisions such as Justice K.S. Puttaswamy v. Union of India (2017) and Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) reinforce the importance of privacy and reliable electronic evidence.

Ultimately, effective backup frequency and retention policies must balance data availability, legal preservation obligations, cybersecurity, and privacy. A properly designed system protects institutional knowledge, supports scientific research, reduces operational risks, and ensures organizational accountability.