SOP for Backup and Restoration of Laboratory Data

In short: This illustrative SOP template covers backup, archival, restoration, and recovery checks for laboratory and other computerized systems that hold quality records. Adapt it to the site’s system inventory, validated processes, data-risk assessment, retention rules, and recovery needs before use. The dates and media in this example are in-house proposals, not regulatory frequencies or defaults.

Objective

Describe controlled steps for making and checking copies of electronic records, restoring records when needed, and documenting system recovery without losing data or obscuring the original record.

Scope

Use this template for laboratory and other computerized systems that create or hold manufacturing, testing, quality, or other regulated records. The site must identify the systems and records covered, their data owners, system owners, interfaces, and approved backup method. Do not treat this template as an instruction to copy files manually from an instrument computer or to change a validated system configuration.

For a system used in U.S. drug manufacturing, 21 CFR 211.68(b) requires a backup file of data entered into the computer or related system, subject to the regulation’s stated exception, and requires backup data to be exact, complete, and secure from alteration, inadvertent erasure, or loss. The FDA’s December 2018 data-integrity guidance explains that a backup should be a true copy of the original record, including associated metadata, in the original or a compatible format and kept securely throughout the record-retention period. For GMP computerized systems covered by EU GMP Annex 11, §§7.1–7.2 call for data protection, accessibility/readability/accuracy checks, regular backups, and checks of backup integrity and the ability to restore data during validation and periodically.

Responsibilities

Example in-house criterion (not a pharmacopoeial requirement): IT prepares and operates the approved backup procedure. The system owner and record owner confirm which data, metadata, audit trails, system configuration, and interfaces must be protected. QA reviews the procedure and its implementation. The Head of QC or other designated quality authority approves a restoration when the affected records or laboratory work require it.

Assign responsibilities for requesting, authorising, performing, independently checking, and documenting each backup and restore. Restrict system and storage access to authorised people under the site’s approved access-control procedure.

Procedure

1. Approve the system-specific backup plan

Before routine operation, document:

• the system and record inventory, including raw data, processed results, metadata, audit trails, methods, configuration, and interfaces needed to reconstruct the work;
• the backup method, format, destination, frequency, retention period, and responsible roles;
• the system’s approved data-loss and recovery targets and the manual or alternative process for critical operations;
• how backup accuracy, completeness, accessibility, readability, security, and restoration capability will be checked;
• how failures, missed backups, data corruption, and restoration incidents will be reported and investigated.

Use the approved, system-appropriate backup process and preserve records in their original format or a compatible format that retains their content and meaning. A folder copy or printout should not be assumed to be a complete backup of an electronic record. Keep relevant metadata and audit-trail information linked to the data.

This example SOP copies backup folders from instrument PCs to a local backup server or portable device. Use that method only if it is the approved, tested process for the specific system.

2. Backup and verification

1. Check that the system is available and that the approved backup job or method is due. Follow the validated method and avoid changing or deleting source records as part of the backup.
2. Record the system identifier, date and time, data period covered, backup destination or job reference, and person performing the activity.
3. Review the job result and record any warning, failure, missing source, or deviation. Escalate a failed or incomplete backup under the site’s incident procedure; do not describe a failed run as successful.
4. Perform the planned verification of backup integrity and accuracy. Confirm that files or records can be accessed, read, and interpreted with the associated metadata and audit trail where applicable.
5. Check restoration capability under the approved validation and periodic-check plan. Record the test scope, sample records or data sets, result, reviewer, and any issue requiring investigation.

EU GMP Annex 11 §7.2 calls for regular backup and for backup integrity, accuracy, and restoration ability to be checked during validation and monitored periodically. It does not set the exact dates or intervals listed in this example SOP.

3. Example backup schedule

Example in-house criterion (not a pharmacopoeial requirement): This example SOP proposes this schedule: weekly backups on the 7th, 14th, and 21st of each month, moved to the next working day when a date is a non-working day; a monthly backup in the first week of the following month; daily backup of data in the shared drive under the backup-server schedule; a yearly backup in the first week of January; off-site copies on a quarterly basis; and restoration verification once every six months. Select and approve the actual schedule for each system based on documented data and recovery risks.

This example also proposes folder paths in the form Department ID/Instrument ID/Weekly/DDMMYYYY, with Monthly or Yearly replacing Weekly for the other tiers. Use a controlled naming convention only if it is part of the approved architecture and uniquely identifies the system and covered period.

4. Off-site copies and archives

Example in-house criterion (not a pharmacopoeial requirement): This example proposes keeping one archival copy at the corporate office and another in a fire-resistant cabinet at the site. It names a portable hard drive or CD/DVD and a gate-pass record for transfer. It proposes identifying archived media with the application name, system ID, covered period, and contents. These are example arrangements, not validated storage or transport requirements.

Distinguish recovery backups from long-term archives in the site procedure. For archived data, define who maintains the media or repository, how authorised staff retrieve it, how readability and integrity are checked, and how data remain available for the full retention period. EU GMP Annex 11 §§7.1 and 17 address availability, readability, integrity, and retrieval of stored or archived data.

5. Restoration and return to service

1. Record the restoration request, affected system and data, reason, date, and proposed scope. Obtain prior approval from the designated quality authority where regulated records or laboratory work are involved.
2. Only authorised personnel may perform the restore. Use the approved procedure and verify the target system, restore point, data period, and application or software version before loading records.
3. Protect the current system state and retain the source backup. Do not overwrite original data or make changes to restored records through the restore procedure.
4. Verify that the restored data are complete, accurate, readable, and usable, including associated metadata and audit-trail information where applicable. Check the system’s intended functions before returning it to routine use.
5. Record what was restored, source and target, verification performed, results, deviations, approver, and release decision. Investigate unsuccessful or incomplete restoration under the site’s incident and deviation procedures.

This example says that modified restored data should be backed up again with a remark. Any correction or change after restoration must follow the approved change-control and data-integrity process, preserve the original, and retain a traceable link between versions.

Example in-house criterion (not a pharmacopoeial requirement): This example requires prior approval from the Head of Quality Control and limits restoration to authorised personnel. Confirm for each system whether that approval route is appropriate, including when QA, the record owner, or the system owner must review the restore before the system returns to use.

6. Users’ shared-drive data

This example instructs users to store essential data in a mapped shared drive daily and says that server data are backed up daily according to the server schedule. A user saving to a shared drive does not by itself establish that all source-system records have been captured in a complete, recoverable backup.

Records

Example in-house criterion (not a pharmacopoeial requirement): Keep a controlled backup and restoration log with the date and time, system ID, data period, backup or restore type, destination or source, performer, verifier, result, remarks or deviation reference, and approval where required. Record any failed job, integrity concern, recovery test, or restoration issue in the applicable incident or quality system.

Retain batch-specific GMP records at least one year after expiry of the respective product batch. EU GMP Part I Chapter 4 §4.11 requires batch documentation to be kept for one year after expiry or at least five years after Qualified Person certification, whichever is longer. 21 CFR 211.180(a), current eCFR edition (2026), requires at least one year after expiry for production, control, or distribution records specifically associated with a drug-product batch. Retain data longer when applicable law or the marketing authorisation requires it.

Training and controlled forms

Example in-house criterion (not a pharmacopoeial requirement): Train personnel on their assigned backup, verification, transfer, or restoration steps before they perform them. Use the site’s controlled forms for backup activity, data retrieval and restoration, and media transfer where these activities are in scope.

Related procedures

• Computerised system introduction and validation
• Data integrity
• Data integrity in the pharmaceutical industry

Frequently asked questions

Is a temporary copy enough to meet backup requirements?

For records covered by U.S. drug CGMP, 21 CFR 211.68(b) requires a backup file, and FDA’s December 2018 guidance explains that a temporary crash-recovery copy alone does not meet that requirement. The retained copy should be exact, complete, secure, and include associated metadata.

How often must a GMP backup be taken?

The cited provisions do not prescribe this example SOP’s specific calendar dates. For EU GMP systems, Annex 11 §7.2 calls for regular backups and periodic checks of backup data and restoration capability. The site should document and approve system-specific intervals.

What should a restore test demonstrate?

It should show that the chosen records can be retrieved and read accurately, with their associated context, and that the system can resume its intended use under the approved procedure. Document the test and investigate any gap.

References

1. European Commission. EudraLex Volume 4, EU Guidelines for Good Manufacturing Practice, Annex 11: Computerised Systems (January 2011), §§1, 4.8, 7.1–7.2, 12, 16–17. Official Annex 11 PDF.
2. United States Electronic Code of Federal Regulations. 21 CFR §211.68(b), automatic, mechanical, and electronic equipment (current eCFR edition, 2026; accessed 19 October 2026). Official regulation.
3. U.S. Food and Drug Administration. Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry (December 2018), §1(e). Official FDA guidance.
4. European Commission. EudraLex Volume 4, EU Guidelines for Good Manufacturing Practice, Part I, Chapter 4: Documentation (January 2011), §4.11. Official Chapter 4 PDF.
5. United States Electronic Code of Federal Regulations. 21 CFR §211.180(a), general record-retention requirements (current eCFR edition, 2026; accessed 19 October 2026). Official regulation.