There must be procedures in place to ensure that data in FDA regulated computer systems is retained throughout the required lifetime of the data.

Data stored within computer systems should be protected throughout the full record retention period.

During this period, electronic records should be able to be accessed or retrieved within a reasonable period of time.

Organizations need to plan for such common contingencies due to hard drive or server failures by implementing policies around:

• Data backup and recovery
• Data archiving
• Disaster recovery and business continuity plans

One of the central points of 21 CFR 11 is that electronic records must be treated identically to paper records; therefore, electronic records must be retained for the same length of time as paper.

Two Year Retention Period

For example, most clinical data must be retained for at least two years beyond the final disposition of the research drug.

Seven Year Retention Period

Most manufacturing records must be retained for up to seven years beyond the expiration of the manufactured product.

Organizations that use computer systems must be prepared to retain their electronic data for years into the future.