FDA Findings: Deleted Data and Missing Backups

A result you cannot reproduce from its original data is a result you cannot defend. When electronic raw data is deleted, never backed up, or lives on a single machine nobody controls, the batch release built on it loses its foundation. Three Warning Letters show three ways data stops being enduring and available.

Background: data integrity and ALCOA+ in practice.

What FDA found

Company X1 — release data deleted, no backups

Cited under 21 CFR 211.68(b). According to the letter, electronic raw data for release testing of batches on the US market had been deleted and was no longer accessible, the firm did not adequately maintain backups of data generated by its laboratory equipment, analysts had administrative rights allowing them to change and delete files, and audit trails were disabled on some chromatographic systems.

The firm said it had removed analysts’ administrative rights, enabled audit trails, set up a backup schedule and retested batches with missing data. FDA still found the response inadequate because it did not include a comprehensive review of all laboratory instruments. Under 21 CFR 211.194(a), the same letter describes a batch retested several times for assay, with out-of-specification results neither recorded in the release documents nor investigated.

Company X2 — no traceability, no backup

Cited under 21 CFR 211.68(b). The letter states that laboratory equipment used for finished-product release testing lacked restricted access and sufficient controls: staff had no unique usernames or passwords, had administrator rights allowing uncontrolled deletion or modification of HPLC files, and there was no way to trace who had deleted or modified data. FDA adds that the firm “did not adequately maintain backups of data generated by your laboratory equipment.”

The firm replied that a supplier was evaluating its HPLC data management. FDA found that inadequate, noting the absence of interim measures to protect patients and product quality, and requested an independent assessment of computer system security and integrity.

Company X3 — one computer, taken home

According to the letter, the only computer holding all of the site’s electronic CGMP data was not backed up and was unavailable during the inspection because the analyst had taken it home and could not be reached. A QC manager’s laptop was presented with recent files and drives apparently deleted, and certificates of analysis had been sent to a personal phone through a messaging app and then deleted. FDA stated this “limited FDA’s access to records”, citing FD&C Act section 501(j). Separately, under 21 CFR 211.68(b), a QC analyst could alter results, dates and approval stamps on certificates of analysis from contract laboratories.

Why this happens

Interpretation — the letters state findings, not root causes. These are common patterns, not claims about these firms.

• Backup is an IT topic, so the lab assumes it is done. Nobody checks which instrument PCs are actually in scope, or whether the backup includes raw data and audit trails rather than only the final report.
• Stand-alone PCs and laptops. Data stays on local drives because the instrument came that way, and the PC is never connected to a managed server.
• Delete rights are the default. If analysts can delete files, sooner or later files get deleted — by accident or not — and nothing records who did it.
• Personal tools creep in. Messaging apps and personal devices are convenient, but records on them are outside every control.

What good looks like

Example: a fictional QC lab with an HPLC network and two stand-alone instruments, using a CDS we’ll call ChromaLog.

1. Inventory first. List every computerised system that creates GxP data, where its data physically sits, and who owns it. Stand-alone instruments and laptops are on the list.
2. No delete for users. Routine users cannot delete or overwrite raw data, in the application or from the operating system. Data that needs to be removed from active use is archived through a controlled, recorded process.
3. Back up what matters. Raw data, metadata and audit trails — not just PDFs — are backed up automatically to a managed location on a defined frequency. FDA’s guidance describes a backup as a true copy of the original record, kept securely throughout the retention period.
4. Prove the restore. Restoring a backup is tested during validation and periodically afterwards, and the restored data is compared with the original. “Backup job successful” proves the job ran, not that the data can be recovered.
5. Company devices and channels only. GxP records are created, sent and stored only on controlled systems. Personal phones and messaging apps are excluded by procedure — and the procedure is checked.
6. Make loss an event. A missing file, failed backup or unreadable archive opens a deviation with an impact assessment on the results it supported.

Perspective: what FDA’s requests tell you

In all three letters FDA did not accept fixes limited to the instrument where the problem was found. It asked for a review of all laboratory instruments (X1), an independent security and integrity assessment with interim controls (X2), and evidence of patient-protection measures in the meantime. The lesson for a validation or QA team: when one system fails on data retention, the question an inspector will ask next is “how do you know the others are fine?” — and the answer has to be evidence, not assumption.

Regulatory basis

• 21 CFR 211.68(b) — appropriate controls over computer systems; backup data must be exact, complete and secure from alteration, inadvertent erasure or loss.
• 21 CFR 211.194(a) — laboratory records must include complete data from all tests.
• 21 CFR Part 11, §11.10(c) — protection of records to enable their accurate and ready retrieval throughout the retention period.
• FDA guidance: Data Integrity and Compliance With Drug CGMP — Questions and Answers (December 2018), question 1(e) on what “backup” means under § 211.68(b), and question 4 on restricting access. Guidance is non-binding; the regulations are.

EU angle

Check current versions on EudraLex before relying on specific clauses. EudraLex Volume 4, Annex 11 (2011) covers data storage and backup in clause 7 and security in clause 12. A revised Annex 11 was published as a draft for consultation in July 2025.

Takeaways

• If analysts can delete raw data, you cannot prove they didn’t.
• A backup you have never restored is a hope, not a control.
• One unmanaged PC can hold the only copy of your release data.
• Fix the system class, not just the instrument that got caught.