A foundational aspect of quality assurance in the life sciences industry is being able to trust the data collected during all lifecycle stages of a pharmaceutical or medical device product, from RD and clinical development through commercialization, manufacturing, distribution, and beyond.
That’s where data integrity comes in, with regulatory bodies such as the FDA, EMA, and MHRA mandating rules for ensuring its completeness, consistency, and accuracy.
In this post, I’ll explain why data integrity in pharma is important, how to stay compliant with data integrity requirements in the US and EU, and provide a number of suggestions for best practices if you’re new to data integrity practices.
Key takeaways
What is data integrity in pharma?
According to the FDA’s guidance on Data Integrity and Compliance with cGMP, data integrity refers to the “completeness, consistency, and accuracy of data.” Data integrity principles safeguard trustworthiness by ensuring data is complete, consistent, and accurate.
Data integrity is sometimes confused with data security. While data security focuses on protecting data from unauthorized access or breaches, data integrity focuses on ensuring the data itself remains accurate, complete, and trustworthy.
Data integrity is absolutely crucial in GxP environments across the whole product lifecycle.
Why? Because if you can’t trust the data, you can’t trust:
-
Laboratory or clinical test results, procedures, or conditions
-
Evidence of the safety or efficacy of a product collected during clinical trials
-
Quality and consistency of products and procedures during manufacturing
-
Conditions encountered by products (or ingredients of products) during distribution
This is because there is a wide range of potential data integrity errors, as shown by the figure below, including human error, hardware failures, network issues, cyber-attacks, and fraud.
Figure 1. Types of data integrity errors, Source: Ensuring data integrity: Best practices and strategies in pharmaceutical industry; D. Gokulakrishnan, S. Venkataraman; Intelligent Pharmacy, 2025
What are the 5 principles of data integrity?
According to FDA guidance on data integrity, the five principles of data integrity for complete, consistent, and accurate data are that data should be:
-
Attributable (A): Who (or what system) created, viewed, edited, or deleted it? Actions can be traced to a specific individual or system.
-
Legible (L): Can it be read? Data must be readable, understandable, and permanent throughout the retention period.
-
Contemporaneous (C): Exactly when was an action taken? Data is recorded at the exact time the action occurs.
-
Original or a true copy (O): Is it the source? The source data or a verified true copy is retained.
-
Accurate (A): Is it correct? Records reflect the true result without error or manipulation.
This is shortened to the acronym ALCOA. In addition to the five principles of ALCOA, there are four additional principles required for data integrity to follow ALCOA+, as required by the FDA.
There are:
-
Complete: Is it whole?
-
Consistent: Is it logical and consistently formatted?
-
Enduring: Does it last and remain intact for the entire duration of the required retention period?
-
Available: Can it be found within a validated and searchable system?
How data integrity principles apply to static and dynamic records
Data integrity in pharma also applies differently to static and dynamic records. Static records (such as paper printouts or electronic images) contain fixed information, while dynamic records allow interaction with the underlying data, such as recalculations or baseline adjustments in analytical systems.
Because dynamic data can be reprocessed or modified, systems must retain the original electronic records and audit trails to preserve the full dataset and maintain traceability.
-
An example of a static record is the results extracted from instruments like pH meters or weighing balances. For these instruments, a paper printout or static image may be treated as the original record captured during data acquisition.
-
An example of a dynamic record might be a graphics interface where a user may change baseline clinical variables to generate a set of results. For example, a chromatographic record where a user can enter a new baseline and generate chromatographic peaks and other meaningful clinical measures
8 stages of data lifecycle management
Key components of data integrity in pharmaceutical systems
Computer system design and controls should enable easy detection of errors, omissions, and aberrant results throughout the data’s life cycle. Key components of these systems include metadata, audit trails, user access controls, and electronic signatures.
Why metadata matters for data integrity
Metadata is structured information that describes, explains, or makes it easier to retrieve, use, or manage digital data. In simpler words, metadata is data about the data. According to GMP and cGMP, for data integrity, records should include the following metadata:
-
Date and time of data acquisition
-
User ID of who acquired or generated the data
-
Instrument ID with which information was generated
-
Audit trails
The importance of an audit trail for data integrity
In paper-based systems, an audit trail is created through documented corrections and version history. For example, by crossing out an incorrect entry with a single line, entering the corrected value, and adding the date, time, and initials of the person making the change.
For electronic records, an audit trail is a secure, computer-generated, time-stamped electronic record that allows the reconstruction of the sequence of events associated with data. It provides a chronology of the “who, what, when, and why” behind the creation, modification, or deletion of data.
Electronic audit trails typically record events such as:
-
Data creation
-
Data modification
-
Data deletion
-
Attempts to access a system
-
Attempts to rename or delete files
These records form a critical component of GMP and cGMP-compliant record-keeping because they help ensure that data cannot be altered without traceability. If a value is changed, the system should retain both the original entry and the details of the change, including the identity of the user who made the modification and the time it occurred.
Because audit trails capture changes to critical data, regulators such as the FDA recommend that they are reviewed regularly, typically alongside the associated record and before final approval. Audit trail reviews typically focus on changes to critical data, such as test results, sample identifiers, process parameters, or system configurations.
User access controls
User access controls and unique user IDs are another essential safeguard for maintaining data integrity in pharmaceutical systems. These controls ensure that only authorised personnel can access, modify, or approve records, and that each action performed within a system can be attributed to a specific individual. Strong authentication mechanisms are also an important part of access control systems.
Access controls typically operate through role-based permissions, where users are granted only the level of access necessary to perform their job functions.
For example, a laboratory analyst might be able to enter test results but not modify system configuration settings, while quality assurance personnel may have the authority to review and approve records.
Electronic signatures
Electronic signatures are widely used in pharmaceutical systems to indicate review, approval, or authorship of electronic records. They must meet strict requirements so that they carry the same legal and regulatory weight as handwritten signatures.
In the United States, these requirements are defined in 21 CFR Part 11, which establishes that electronic signatures must be uniquely linked to an individual and cannot be reused or reassigned to another person.
They must also include identifying information such as the signer’s name, the date and time of the signature, and the meaning of the signature (for example, approval or review). Importantly, electronic signatures must be permanently linked to the electronic record they sign so that they cannot be removed, copied, or transferred to another record.
Data integrity depends on having the right systems in place to ensure information is complete, consistent, and audit-ready. Scilife supports this effort as an eQMS provider, helping pharma companies digitalize quality processes and strengthen control over critical data.
Data integrity requirements and guidelines in pharma
In this section, we will dive into key data integrity guidelines in pharma as well as requirements that you need to follow.
FDA data integrity requirements (21 CFR Part 11 cGMP)
In the United States, FDA 21 CFR Part 11 and cGMP require that electronic records be trustworthy, reliable, and equivalent to paper, adhering to the ALCOA+ principles listed above (quick reminder, these are: Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available).
Key requirements for electronic systems include system validation to ensure accuracy and reliability, time-stamped audit trails that record the creation, access/viewing, modification, or deletion of data, restricted system access using unique user identities, and linked electronic signatures to provide traceability.
The data also has to be stored and readily retrievable for the required period, which can be decades.
EU Annex 11 EudraLex Volume 4
In the EU, there is an equivalent set of rules and guidelines from the EMA, called EU Annex 11 EudraLex Volume 4. There’s a huge amount of overlap between the EMA and the FDA’s requirements (audit trails, security access and controls, data accuracy and consistency), so it’s probably more helpful and interesting if we focus on the key differences.
Key differences between EU and FDA requirements:
-
Scope: EU Annex 11 applies to all computerized systems used in GMP processes, while US Part 11 focuses specifically on electronic records and electronic signatures used in FDA-regulated activities.
-
Risk-based approach: EU requirements emphasize a documented risk-based approach to validation and data integrity controls, prioritizing patient safety and product quality.
-
Supplier oversight: EU regulations require evaluation and auditing of computerized system vendors to ensure software quality and compliance.
-
Regulatory focus: Annex 11 takes a broader systems-level approach to computerized system governance, whereas Part 11 concentrates more narrowly on electronic records and signature compliance.
-
Audit trails: Annex 11 requires audit trails for GMP-critical data and emphasizes their review, while Part 11 mandates audit trails for electronic records more generally.
-
Lifecycle validation: Annex 11 promotes a lifecycle approach to system validation, covering the entire system lifespan from implementation to retirement.
MHRA data integrity guidance
Data integrity guidance in the UK comes from the MHRA and covers all types of GxP (Good Manufacturing, Clinical, Laboratory, and Distribution Practices). MHRA guidance on data integrity takes a risk-based approach (focusing on preventing data integrity issues) and emphasizes the use of organizational culture, audit trails, and ALCOA+ principles.
PIC/S WHO Guidelines
PIC/S (PI 041-1) and WHO (Annex 4) guidelines provide harmonized, comprehensive frameworks for ensuring data integrity (accuracy, completeness, consistency) throughout the GxP data lifecycle. They take a risk-based approach and emphasize ALCOA+ principles, requiring robust data governance, risk management, and secure computerized systems to prevent data manipulation.
Fundamentals of data integrity and data governance certification at the Scilife Academy
What are the common challenges faced by pharma companies in ensuring data integrity?
Pharma companies face critical data integrity challenges rooted in human error, inadequate system validation, and a lack of or weak data governance cultures.
Key areas that lead to data integrity in pharma issues include:
-
Human error and behavioral issues: Unintentional errors in manual data entry, lack of training, and poor documentation practices are primary causes.
-
Legacy systems and IT gaps: Using outdated, unvalidated systems that lack robust audit trails, user access controls, or secure data storage (e.g., electronic data modification).
-
Lack of data governance culture: A culture that pressures employees to meet targets at the cost of compliance, or a failure to establish clear data management procedures.
-
Complex data environments and siloes: Managing data across disparate systems and external outsourcing partners, which creates fragmentation and makes it difficult to ensure consistency.
-
Inadequate audit trails: Inability to properly track, review, and secure metadata and changes, hindering the ability to reconstruct events.
-
Cybersecurity threats: As systems become more digitized, risks increase regarding data breaches, tampering, or deletion.
What is a data integrity assessment?
A data integrity assessment is a systematic review that validates the accuracy, consistency, and reliability of data across its entire lifecycle, from creation to disposal, ensuring it remains trustworthy.
A data integrity assessment is required:
-
To demonstrate regulatory compliance
-
When new computer systems are introduced, or existing ones are updated
-
In preparation for a regulatory audit
-
When transferring data between systems or aggregating from different sources
-
To detect any potential data integrity breaches, such as unauthorized data modification, loss, or unauthorized access
How a digital QMS supports data integrity compliance
For life sciences organizations operating under GxP frameworks, maintaining data integrity is not simply a technical requirement; it is a core expectation of regulatory compliance. The challenge isn’t just understanding these expectations; it’s embedding them into everyday operational workflows across laboratories, manufacturing environments, quality systems, and clinical processes.
That’s where a digital QMS makes the difference.
At Scilife, our Smart Quality Management System (QMS) platform helps life sciences organizations operationalize data integrity requirements by embedding compliant processes directly into controlled digital workflows. Instead of relying on fragmented systems, manual logs, or paper-based documentation that can introduce risk, organizations can manage regulated records within a structured, traceable, and inspection-ready environment.
With the right QMS software, you can:
-
Maintain secure, centralized records that support ALCOA+ data integrity principles
-
Ensure controlled document creation, review, and approval workflows
-
Maintain comprehensive audit trails showing who created, modified, or approved data
-
Manage electronic signatures in line with regulatory expectations
-
Track document versions and maintain complete change histories
-
Ensure data and documentation remain accessible and inspection-ready
A fully digital, configurable QMS enables organizations to move beyond simply documenting compliance to actively supporting data integrity across the GxP data lifecycle.
