Cloud Computing: Regulations for the Return Transmission of Data in the Event of Business Discontinuation
Recommendation
26-29 November 2024
Learn How to Plan, Implement and Document Effectively Computer Validation Activities
The trend towards cloud computing means that a large amount of data is stored by cloud providers. Now, how do you get your complete data if the cloud service provider goes out of business or gets insolvent?
What do Regulations demand and how can they be implemented?
Both the German AMWHV and the EU GMP guidelines consider the responsibility to lie with the RU (Regulated User). The AMWHV focuses on the retension of documentation, i.e. the availability of GxP-critical data. According to § 20 AMWHV, the pharmaceutical manufacturer must take precautions to ensure that the documentation is kept available for the entire storage period in the event of closure of the manufacturing or testing site where the documentation is stored in accordance with sentence 1.
The EU GMP guidelines focus on the business process and thus on the GxP-critical application and data. According to Annex 11 of the EU GMP Guideline, Chapter 16 - "Continuity of business operations" - precautions should be taken to ensure the continuous support of these processes in the event of a system failure (e.g. by a manual or alternative system), if computerised systems support critical processes. The time required to put these alternative processes into operation should be determined on a risk-based assessment for a particular system and the processes supported. These procedures should be adequately documented and tested.
This task/obligation could be included in the service contract with the CSP (Cloud Service Provider) by obliging the CSP to ensure the availability of data and, if necessary, application via an additional subcontractor. However, the RU should evaluate within the scope of a risk assessment whether it would not be reasonable to keep a backup site on premise.
Related GMP News
31.07.2024FDA Warning Letter on Data Integrity Issues
14.02.2024Cloud Computing: Workaround for non-compliant PaaS
07.02.2024Cloud Computing: Validation performed by a CSP on its own - what is the Value?
24.01.2024Cloud Computing: Can an automated Deployment Chain replace an IQ?
17.01.2024Cloud Computing: Consequences of different service models for Qualification / Validation
10.01.2024Cloud Computing: Validation of SaaS; who is accountable?