US-FDA requires medical product companies to retain all (100%) of physical/digital data and information of their medical products from discovery, manufacturing and distribution for the life of the product and two years after the last product is distributed. Other Nations have similar edicts.

HHS-HIPAA is requiring electronic medical records be retained for the life of the patient. The Genetic Information Nondiscrimination Act of 2008 (GINA) is requiring that a patient’s genetic data be maintained for the life of the individual and 50 years after their death (for family use).

“Nothing is more valuable to a pharmaceutical company than the formula for one of its new drugs. Reports of hackers breaking into all sorts of firms and stealing their trade secrets is of enormous concern. Equally troubling, experts warn that theft of trade secrets by company insiders is a larger problem… Many of the victims of cyber theft find themselves the target of class action lawsuits and regulatory actions. A quick look at data breach shows a rapidly changing regulatory environment, growing risks of litigation, and some important insurance implications for companies and their top management.”
– Deloitte

“The UK Government identified pharmaceutical companies as the primary target of cyber criminals bent on stealing IP. It estimated cyber-theft of IP cost the UK ₤9.2b, of which it attributed ₤1.8b to theft of pharmaceutical, biotechnology, and healthcare IP. Surveys of US Cyber-attacks consistently find that pharmaceutical IP is a major target of sophisticated cyber gangs… Attacks against major US pharmaceutical companies… include medical device-maker, Boston Scientific, Abbott Laboratories, and Wyeth, the drug maker acquired by Pfizer Inc.”
– Deloitte

“With the advance of biotechnology, biological information, rather than biological materials, is increasingly the object of principal security concern. We argue that both in theory and in practice, existing security approaches in biology are poorly suited to manage hazardous biological information, and use the cases of Mousepox, H5N1 gain of function, and Botulinum toxin H to highlight these ongoing challenges. We suggest that mitigation of these hazards can be improved if one can: (1) anticipate hazard potential before scientific work is performed; (2) consider how much the new information would likely help both good and bad actors; and (3) aim to disclose information in the manner that maximally disadvantages bad actors versus good ones.”
– Society for Risk Analysis