1Four guidances, one set of principles.
Four documents are the usual reference points for data integrity. None creates new legal requirements; each explains how existing rules apply to data.
| Guidance | Issued | Status | Scope and audience |
|---|---|---|---|
| FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers | December 2018 | Final, Level 1 guidance; non-binding¹ | Drug CGMP under 21 CFR parts 210, 211 and 212, including biologics² |
| MHRA, ‘GXP’ Data Integrity Guidance and Definitions, Revision 1 | March 2018 | UK guidance; for GLP, the OECD advisory document of 20 September 2021 takes precedence³ | UK industry and public bodies regulated by MHRA, across GxP⁴ |
| PIC/S PI 041-1 | 1 July 2021 | “not mandatory or enforceable under law” | Written for GMP and GDP inspectorates, interpreting existing requirements⁵ |
| WHO TRS 1033, Annex 4 | 2021 | Replaces WHO’s 2016 guidance (TRS 996, Annex 5) | “GxP” for medical products, including contract givers and acceptors⁶ |
FDA says its guidance clarifies “the role of data integrity in current good manufacturing practice”.² PIC/S says its guide “is not intended to impose additional regulatory burden upon regulated entities”.⁵
2What they agree on.
The definitions line up. FDA defines data integrity as “the completeness, consistency, and accuracy of data”;² MHRA, whose definition PIC/S adopts, adds that those characteristics are maintained throughout the data life cycle.⁴⁵ FDA and MHRA use the acronym ALCOA, while PIC/S and WHO use ALCOA+, which adds complete, consistent, enduring and available. MHRA says “There is no difference in expectations regardless of which acronym is used”.²⁴⁵⁶ See ALCOA+ for what each attribute means.
They agree on the main controls too:
- The principles apply to paper, electronic and hybrid records.⁵⁶
- Effort is set by risk, weighing how critical the data are and how exposed they are to change or loss.⁴⁵⁶
- Routine data review includes the relevant audit trails, with depth and frequency set by risk.²⁴⁵⁶
- Falsification is among the most serious failures: FDA says suspected falsification must be fully investigated under the quality system, WHO calls for immediate action, and PIC/S classes it as a critical deficiency.²⁶⁵
3Where they differ.
The differences are mostly of form and detail.²⁴⁵⁶
| Topic | FDA | MHRA | PIC/S | WHO |
|---|---|---|---|---|
| Form | 18 questions and answers | Principles and definitions for all GxP | Expectations with “items to be checked” by inspectors | Numbered guideline |
| Audit trail review timing | At the frequency CGMP sets for the record, such as before batch release; otherwise by risk | In routine data review where a risk assessment requires it | Critical trails before the operation is completed, such as batch release; others in periodic system review | Frequency set by system criticality and type of audit trail |
| Telling the regulator | Invites reports of suspected data integrity issues by email, and encourages remediation with a global corrective action plan | Notify regulators where significant incidents are identified | Escalate to national authorities where necessary | Report significant lapses that may affect patients, quality or efficacy |
| Classifying deficiencies | Not covered | Not covered | Critical, major or other, with falsification critical | Not covered |
4How they relate to binding rules.
FDA says “should” in its guidance means “suggested or recommended, but not required”; the binding text is the CGMP regulations it cites.² PIC/S says data integrity deficiencies should be referenced to national legislation or to the PIC/S GMP and GDP guides, and maps the ALCOA principles to clauses in those guides and Annex 11.⁵ MHRA calls its guidance a “UK companion document to PIC/S, WHO, OECD (guidance and advisory documents on GLP) and EMA guidelines and regulations”, harmonised where possible,⁴ and WHO also says it has harmonised where possible.⁶
The EU has no standalone data integrity guidance. EMA publishes questions and answers on data integrity within its GMP guidance, which permit review by exception “when scientifically justified”.⁷ The binding EU text is EU GMP itself, and the version of Annex 11 listed in EudraLex Volume 4 is still the January 2011 revision.⁸ Revisions of Chapter 4 and Annex 11, and a new Annex 22 on artificial intelligence, drafted by the EMA GMDP Inspectors Working Group with PIC/S, were open for consultation from 7 July to 7 October 2025.⁹ The draft Annex 11 would add detail the 2011 text lacks, such as independent audit trail review before batch release unless a later review can be justified; until it is adopted, it is a draft.¹⁰
5Which one to follow.
Follow the guidance of each authority whose rules apply to the work. FDA’s covers drugs under US CGMP and MHRA’s covers UK GxP. PIC/S’s guide was written for inspectorates interpreting GMP and GDP, and WHO’s covers GxP for medical products. Because the documents were harmonised where possible, one set of controls usually satisfies all of them; the work is in the details, such as when audit trail review happens and who does it.⁴⁶
6How it runs in Seal.
Seal’s data integrity and audit trail review blueprint starts from a map of regulated records: each record class has its authoritative system, owner, creation path, retention, review requirement and criticality, and criticality sets which audit trails need event-level review, when and by whom. Periodic review combines access certification, audit-trail completion, exception patterns and archival retrieval, and migration and archival are treated as regulated transformations.
Each record in Seal keeps its audit history and electronic signatures, with controls to support 21 CFR Part 11 and EU GMP Annex 11. Regulatory and validation covers what to demonstrate about those controls during qualification.
References
- 1Data Integrity and Compliance With Drug CGMP: Questions and Answers, guidance document page, FDA, December 2018. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ data- integrity- and- compliance- drug- cgmp- questions- and- answers (read 6 November 2026) - 2Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 3Guidance on GxP data integrity, MHRA, GOV.UK, published 9 March 2018, last updated 27 September 2021. https:/
/ www. gov. uk/ government/ publications/ guidance- on- gxp- data- integrity (read 6 November 2026) - 4‘GXP’ Data Integrity Guidance and Definitions, Revision 1, MHRA, March 2018. https:/
/ assets. publishing. service. gov. uk/ media/ 5aa2b9ede5274a3e391e37f3/ MHRA_ GxP_ data_ integrity_ guide_ March_ edited_ Final. pdf (read 6 November 2026) - 5PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, PIC/S, 1 July 2021. https:/
/ picscheme. org/ docview/ 4234 (read 6 November 2026) - 6Guideline on data integrity, WHO Technical Report Series No. 1033, Annex 4, World Health Organization, 2021. https:/
/ cdn. who. int/ media/ docs/ default- source/ medicines/ norms- and- standards/ guidelines/ inspections/ trs1033- annex4- guideline- on- data- integrity. pdf (read 6 November 2026) - 7Guidance on good manufacturing practice and good distribution practice: questions and answers, data integrity section, European Medicines Agency, undated. https:/
/ www. ema. europa. eu/ en/ human- regulatory- overview/ research- development/ compliance- research- development/ good- manufacturing- practice/ guidance- good- manufacturing- practice- good- distribution- practice- questions- answers (read 6 November 2026) - 8EudraLex Volume 4, Good Manufacturing Practice guidelines, European Commission. https:/
/ health. ec. europa. eu/ medicinal- products/ eudralex/ eudralex- volume- 4_ en (read 6 November 2026) - 9Stakeholders’ Consultation on EudraLex Volume 4, Chapter 4, Annex 11 and New Annex 22, European Commission, consultation 7 July to 7 October 2025. https:/
/ health. ec. europa. eu/ consultations/ stakeholders- consultation- eudralex- volume- 4- good- manufacturing- practice- guidelines- chapter- 4- annex_ en (read 6 November 2026) - 10Annex 11: Computerised Systems, draft revision for consultation, EMA GMDP Inspectors Working Group and PIC/S, July 2025. https:/
/ picscheme. org/ docview/ 9714 (read 6 November 2026)
AQuestions and answers
Is FDA’s 2018 data integrity guidance still current?
Yes. FDA lists Data Integrity and Compliance With Drug CGMP: Questions and Answers, dated December 2018, as final Level 1 guidance. It represents FDA’s current thinking on how the drug CGMP regulations apply to data, but its recommendations are not binding.
Does a company need to follow more than one of these guidances?
Usually, if its work falls under more than one regulator. Each guidance explains the rules its own authority applies. Because MHRA and WHO harmonised their documents with the others where possible, one well-designed set of controls can normally meet all of them, provided the detailed differences are checked.
Does EMA have its own data integrity guidance?
Not as a standalone guideline. EMA publishes data integrity questions and answers within its GMP and GDP guidance, and the binding EU requirements are in EU GMP, including Chapter 4 on documentation and Annex 11 on computerised systems. Revisions of both were published as drafts for consultation in 2025.
What is PIC/S PI 041-1?
PIC/S guidance on good practices for data management and integrity in GMP and GDP environments, dated 1 July 2021. It was written to help inspectorates interpret existing requirements and plan risk-based inspections, and it includes a scheme for classifying data integrity deficiencies.
Are these data integrity guidances legally binding?
No. They explain regulators’ expectations. The binding requirements are the regulations behind them, such as 21 CFR parts 210, 211, 212 and Part 11 in the US, and EU or national GMP law elsewhere. PIC/S tells inspectors to reference data integrity deficiencies to national law or the PIC/S GMP and GDP guides, with its guidance used to interpret them.
Which WHO data integrity guidance is current?
The Guideline on data integrity, published in 2021 as Annex 4 to WHO Technical Report Series No. 1033. It replaces WHO’s 2016 Guidance on good data and record management practices, Annex 5 to Technical Report Series No. 996.