Data backup frequency and retention policies

Introduction

Data backup frequency and retention policies are essential components of information governance, cybersecurity, and organisational risk management. Data backup refers to creating additional copies of digital information so that it can be recovered after accidental deletion, hardware failure, cyberattacks, ransomware incidents, or natural disasters. Retention policies determine how long information must be preserved, when it should be archived, and when it should be securely deleted.

These policies are particularly important in biotechnology, healthcare, pharmaceutical research, genetic databases, clinical trials, and agricultural biotechnology. Such organisations maintain valuable information, including research findings, genetic sequences, patient records, laboratory results, and regulatory documents. Loss or unauthorised destruction of these records may cause financial damage, interrupt scientific research, and create legal liability.

International legal framework

The General Data Protection Regulation (GDPR), 2016, of the European Union establishes important requirements concerning data security and retention. Article 5(1)(e) introduces the storage limitation principle, under which personal data should not be retained longer than necessary for the purposes for which it is processed.

Article 32 requires organisations to implement appropriate technical and organisational security measures. These include the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and the ability to restore the availability of personal data following a physical or technical incident.

The ISO/IEC 27001:2022 standard provides an information security management framework. Its controls address information backup, access management, business continuity, and protection against data loss.

The ISO/IEC 27002:2022 standard provides additional guidance on information security controls, including backup arrangements and secure information handling.

The NIST Cybersecurity Framework 2.0, published in 2024, also provides guidance on governance, protection, detection, response, and recovery. Its recovery principles support the development of reliable backup and restoration procedures.

Indian legal and regulatory framework

India's legal framework contains several provisions relevant to backup frequency and retention policies.

The Information Technology Act, 2000 provides the principal legal framework for electronic information security. Section 43 addresses unauthorised access, copying, and damage to computer resources. Section 66 establishes criminal consequences for specified acts committed dishonestly or fraudulently.

Section 70B authorises CERT-In to perform cybersecurity incident-response functions. The CERT-In Directions of 2022 require covered entities to report specified cybersecurity incidents within six hours of noticing them or being informed about them. They also require covered entities to maintain ICT system logs securely for a rolling period of 180 days within Indian jurisdiction.

The Digital Personal Data Protection Act, 2023 establishes obligations concerning the protection and processing of digital personal data. Data fiduciaries must adopt reasonable security safeguards to prevent personal data breaches. The Act also provides for erasure when the purpose of processing is no longer served, subject to applicable legal retention requirements.

The Companies Act, 2013, particularly Section 128, requires companies to maintain proper books of account and relevant financial records for the prescribed period. Such records must be preserved in accordance with applicable legal requirements.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 also provide security-related requirements for covered bodies corporate handling sensitive personal information.

Data backup frequency requirements

Backup frequency refers to how often an organisation creates copies of its important information. The appropriate frequency depends on the sensitivity of data, operational requirements, financial risks, and the consequences of data loss.

1. Daily backups

Daily backups are appropriate for databases that change regularly, including patient records, research documentation, laboratory reports, and financial information.

2. Real-time or continuous backups

Continuous data protection is useful for critical systems where even a short period of data loss could seriously affect operations. Hospitals, genetic testing laboratories, and biotechnology manufacturing facilities may require frequent or near-real-time backups.

3. Weekly backups

Weekly backups may be suitable for less frequently updated information, archival records, and certain administrative documents. However, they should not replace more frequent backups for critical operational databases.

4. Monthly archival backups

Monthly backups may be used for long-term preservation of research findings, regulatory submissions, historical reports, and other records requiring extended retention.

Data retention policies

A retention policy establishes how long an organisation must preserve different categories of information. Retention periods should be determined according to legal obligations, operational requirements, research needs, and privacy principles.

Important considerations include:

Medical records: Retention must follow applicable healthcare and professional requirements.

Financial records: Companies must comply with statutory accounting and audit requirements.

Research records: Scientific institutions should preserve records according to applicable research ethics, funding, and institutional requirements.

Cybersecurity logs: Covered entities must follow applicable CERT-In retention requirements.

Personal information: Data should not be retained indefinitely without a lawful and necessary purpose.

Organisations should also maintain secure deletion procedures so that expired information cannot be recovered or accessed without authorisation.

Important case laws

1. Shreya Singhal v. Union of India (2015)

The Supreme Court of India examined the constitutionality of Section 66A of the Information Technology Act, 2000, and struck it down for violating freedom of speech and expression. Although the case did not directly concern backup policies, it is relevant to understanding the constitutional limits of digital regulation and the need for lawful handling of electronic information.

2. Justice K.S. Puttaswamy v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21. The judgment established important principles concerning informational privacy, data protection, and individual autonomy. These principles support responsible retention policies because organisations should avoid retaining personal information longer than necessary.

3. District Registrar and Collector v. Canara Bank (2005)

The Supreme Court recognised the importance of privacy and confidentiality in personal records. The decision is relevant to secure storage, restricted access, and responsible preservation of confidential information.

4. State of Punjab v. Shamlal Murari (1976)

The Supreme Court discussed the importance of procedural requirements in the administration of justice. Although the case did not concern digital backups or data retention, it provides broader guidance on the importance of following prescribed legal procedures. Its connection with modern backup policies is indirect.

These decisions provide broader legal principles rather than direct judicial standards prescribing backup frequency or retention periods.

Institutional responsibilities and compliance challenges

Organisations handling sensitive information must establish documented backup and retention policies. They should classify information according to importance, establish recovery objectives, and periodically test whether backups can be restored successfully.

A useful technical approach is the 3-2-1 backup strategy:

Maintain three copies of important information.

Store copies on two different types of storage media.

Keep at least one copy in an off-site or otherwise isolated location.

Institutions should also use encryption, access restrictions, immutable backups, and regular recovery testing. Backup systems should be protected against ransomware because attackers may attempt to compromise both original databases and their backup copies.

A major legal challenge is balancing long-term record preservation with the right to privacy and the principle of data minimisation. Another challenge arises when records are stored across different countries or third-party cloud platforms, creating questions concerning jurisdiction, access, and legal compliance.

Conclusion

Data backup frequency and retention policies are essential for protecting organisational information, maintaining business continuity, and preventing permanent data loss. India's Information Technology Act, 2000, Digital Personal Data Protection Act, 2023, Companies Act, 2013, and CERT-In Directions provide relevant legal requirements. International standards such as GDPR, ISO/IEC 27001, and the NIST Cybersecurity Framework offer additional guidance. Effective implementation requires risk-based backup schedules, legally compliant retention periods, secure storage, regular recovery testing, and responsible deletion procedures.