1.0 OBJECTIVE:
1.1. The purpose of this SOP is to define a structured and controlled Disaster Recovery Plan (DRP) to ensure the rapid restoration of all Pharmacovigilance (PV) systems, applications, critical data, and communication channels in the event of a system failure, data corruption, cyber-attack, natural disaster, or any incident affecting the availability or integrity of PV operations.

1.2. This SOP ensures compliance with European Union Good Pharmacovigilance Practices (EU-GVP), WHO Prequalification (WHO PQ) expectations, and internal Quality Management System (QMS) requirements.

1.3. The procedure supports business continuity by ensuring that no Individual Case Safety Report (ICSR), periodic report, safety communication, or compliance obligation is missed due to system disruptions.

2.0 SCOPE:
2.1 This SOP applies to all PV systems and tools, including but not limited to:
2.1.1 Safety databases
2.1.2 PV mailbox(es)
2.1.3 E2B gateway or reporting portals
2.1.4 Literature screening tools
2.1.5 PV document repositories (PSMF, SOPs, logs)
2.1.6 Periodic reporting files (PSUR, PBRER)
2.1.7 Signal management databases
2.1.8 Backup storage systems
2.1.9 Cloud-based PV systems, if applicable

2.2 This SOP applies to the PV Department, IT Department, Quality Assurance (QA), Regulatory Affairs (RA), and all external vendors supporting PV technology services.

3.0 RESPONSIBILITIES:
3.1. Pharmacovigilance (PV) Department:
3.1.1 Immediately identify and report any PV system failure to IT and QA.
3.1.2 Activate interim manual PV processes if required (as per BCP).
3.1.3 Verify accuracy and completeness of data restored after recovery.
3.1.4 Maintain logs of system downtime, recovery activities, and reconciliation.
3.1.5 Lead the technical execution of disaster recovery activities.
3.1.6 Restore systems according to defined RTO and RPO timelines.
3.1.7 Ensure availability of backup servers, cloud recovery systems, and data restoration tools.

3.2. Quality Assurance (QA):
3.2.1 Verify that DRP is implemented in compliance with the QMS.
3.2.2 Ensure DRP testing is performed periodically and documented.
3.2.3 Approve final incident closure after PV confirms data integrity.

4.0 DEFINATIONS:
4.1 Disaster Recovery Plan (DRP): A documented procedure that describes how PV systems and data will be restored to operational status following a system outage or disaster.

4.2 Critical PV Systems: Systems essential for PV compliance, such as safety databases, PV mailbox, reporting portals, and document repositories.

4.3 Recovery Time Objective (RTO): Maximum acceptable downtime before PV compliance is impacted.

4.4 Recovery Point Objective (RPO): Maximum acceptable data loss based on most recent backup.

4.5 System Outage: Any failure preventing access to PV tools, databases, or communication systems.

5.0 PROCEDURE:
5.1 Identification of Disaster or System Failure:
5.1.1 A disaster may include:
5.1.1.1 Server crash or hardware failure
5.1.1.2 Corrupted safety database
5.1.1.3 Loss of PV mailbox access
5.1.1.4 Data center outage
5.1.1.5 Cyber-attack or ransomware
5.1.1.6 Natural disaster affecting infrastructure
5.1.1.7 Loss of internet required for regulatory reporting

5.1.2 PV personnel shall immediately log the incident and inform IT, QA, and QPPV.

5.2 Activation of Disaster Recovery Plan:
5.2.1 The PV Head or QPPV shall authorize DRP activation after confirming system unavailability.

5.2.2 PV shall simultaneously activate manual processes as per BCP to maintain compliance (e.g., manual ICSR intake log).

5.3 Backup Management & Restoration Process:
5.3.1 IT / PV shall retrieve the latest valid backup according to RPO requirements.

5.3.2 Backups may include:
5.3.2.1 Safety database snapshots
5.3.2.2 Email archives (PV mailbox)
5.3.2.3 Literature screening outputs
5.3.2.4 PSUR/PBRER working files
5.3.2.5 Signal management documents

5.3.3 IT / PV shall restore systems in the following priority order:
5.3.3.1 PV mailbox
5.3.3.2 Safety database
5.3.3.3 Regulatory reporting systems
5.3.3.4 Signal management tools
5.3.3.5 Literature screening systems
5.3.3.6 Document repository

5.3.4 PV shall verify:
5.3.4.1 Integrity of restored ICSRs
5.3.4.2 Completeness of email reports
5.3.4.3 Consistency of database entries
5.3.4.4 Status of pending submissions

5.3.5 Any missing data shall be reconstructed using manual logs maintained during downtime.

5.4 System Validation and Restart of PV Operations:
5.4.1 After restoration, IT shall confirm system stability and access rights.

5.4.2 PV shall conduct a validation check including:
5.4.2.1 Sample case audits
5.4.2.2 Database search checks
5.4.2.3 Literature system functionality
5.4.2.4 Signal management tool responsiveness

5.4.3 Only after validation is complete may normal PV operations resume.

5.5 Documentation of Disaster Recovery Activities:
5.5.1 All incidents shall be documented in the PV System Failure Log, including:
5.5.1.1 Nature of failure
5.5.1.2 Date and time of occurrence
5.5.1.3 Impact on PV operations
5.5.1.4 Duration of downtime
5.5.1.5 Steps taken to recover
5.5.1.6 Any data discrepancies

5.5.2 PV shall document reconciliation of ICSRs, literature cases, and signals.

5.5.3 A deviation and CAPA shall be initiated for any compliance impact.

5.6 Testing of DRP:
5.6.1 DRP shall be tested at least once every 12 months or when significant system changes occur.

5.6.2 Mock recovery tests shall be documented, including time required and issues identified.

5.6.3 QA shall verify that test results meet RTO and RPO requirements.

5.7 Closure of Disaster Event:
5.7.1 After full recovery and reconciliation, PV shall submit a summary report to QA and QPPV.

5.7.2 QA shall review, request corrective actions if needed, and approve incident closure.

5.8 Training:
5.8.1 All PV and IT personnel involved in DRP shall be trained on this SOP.

5.8.2 DRP training shall be repeated annually and after significant system changes.

5.9 Deviation:
5.9.1 Any deviation from this SOP shall be documented according to the Deviation & CAPA SOP.

6.0 REFERENCES:
6.1 WHO Technical Report Series (TRS) – PV guidance

6.2 EU Good Pharmacovigilance Practices (GVP)

6.3 Company QMS SOPs (Document Control, Training, Audit, Risk Management, Deviation & CAPA)

7.0 RECORDS:
Sr No. Title Document No.
1 Disaster recovery activation form F/PV009/001 – 00
2 Backup restoration report F/PV009/002 – 00
3 DRP test report F/PV009/003 – 00
4 PV reconciliation report F/PV009/004 – 00

8.0 REVISION HISTORY.
Amendment Date: Update Summary Version No.
NA New SOP 01