Record Protection and Retention — §11.10(c)

Record Protection and Retention. Electronic records shall be protected to enable their accurate and ready retrieval throughout the entire records retention period established by applicable predicate rules and organizational policies, in accordance with §11.10(c). The organization shall implement the following safeguards: (a) electronic records shall be stored in a manner that prevents unauthorized alteration, deletion, or destruction throughout the retention period; (b) backup and recovery procedures shall be established and tested to ensure records can be restored in the event of system failure, data corruption, or disaster; (c) backup copies shall be stored in a geographically separate, secure location with environmental controls appropriate for the storage media; (d) backup integrity shall be verified through periodic restore testing, conducted at least annually; (e) when records are migrated from one system to another, or from one storage medium to another, the migration process shall be validated to ensure that the content, meaning, context, and integrity of the records are preserved; (f) a record retention schedule shall be maintained that identifies the retention period for each category of electronic record based on the applicable predicate rule requirements (e.g., 21 CFR 211.180 requires batch production records to be retained for at least one year after the expiration date of the batch); and (g) records shall not be destroyed before the expiration of the applicable retention period, and any destruction shall be documented and authorized by the Quality Unit.