1What data integrity means.
FDA defines data integrity as “the completeness, consistency, and accuracy of data”, and says complete, consistent and accurate data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate: the ALCOA principles.¹ MHRA’s definition, which PIC/S adopts, adds that data are “trustworthy, reliable” and that these characteristics “are maintained throughout the data life cycle”.²³ That life cycle runs from creation through processing, use, retention and archive to disposal at the end of the retention period.¹²
PIC/S and WHO use ALCOA+, which adds complete, consistent, enduring and available.³⁴ MHRA keeps ALCOA but says “There is no difference in expectations regardless of which acronym is used”.² PIC/S sets out what each attribute means in practice.³
| Attribute | What it requires |
|---|---|
| Attributable | You can identify the person or system that performed a task and when, including who changed a record, when and why. |
| Legible | Records are readable and unambiguous, and dynamic electronic data stay usable in a suitable application. |
| Contemporaneous | Actions, events and decisions are recorded as they take place. |
| Original | The first capture of the information is kept, in its dynamic state if it was captured that way. |
| Accurate | Records are a truthful representation of the facts. |
| Complete | Nothing needed to recreate the event is lost or deleted, including relevant metadata. |
| Consistent | Data are created, processed and stored in a defined, logical way, such as consistent date formats and units. |
| Enduring | Records stay intact and accessible for the whole retention period. |
| Available | Records can be reviewed at any time in the retention period by the people responsible. |
Metadata are part of the record. FDA’s example is the number “23”, which means nothing without its unit, “mg”; metadata also include the time stamp, the user ID, the instrument ID and audit trails.¹ Integrity is not the same as quality: MHRA notes that “the controls required for integrity do not necessarily guarantee the quality of the data generated”.²
2Where the requirement comes from.
In the US, data integrity requirements sit in the drug CGMP regulations, and FDA’s guidance of December 2018 explains how they apply.¹ 21 CFR 211.68 requires backup data to be “exact and complete” and “secure from alteration, inadvertent erasures, or loss”.⁵ 211.100 requires production and process control functions to be “documented at the time of performance”,⁶ and 211.180 allows records to be kept as original records or true copies.⁷ FDA also points to 211.188 and 211.194, which require complete information and complete data from all tests, and to 211.192, under which the quality unit reviews production and control records. Part 11 adds the rules for electronic records and signatures.¹
FDA’s guidance is not itself binding: “should” in a guidance “means that something is suggested or recommended, but not required”. The regulations it cites are binding.¹ In the EU, EMA describes data integrity as a fundamental requirement of the pharmaceutical quality system in EU GMP Chapter 1, “applying equally to manual (paper) and electronic systems”.⁸ PIC/S says its own guide is “not mandatory or enforceable under law” and that deficiencies are referenced to national law or to the PIC/S GMP and GDP guides.³ The guidance compared page sets the four main guidances side by side.
3Why it matters.
Batch release, stability conclusions and regulatory submissions are only as sound as the records behind them. PIC/S calls data integrity “a fundamental requirement for an effective Pharmaceutical Quality System” and warns that poor practices “may ultimately undermine the quality of medicinal products”.³ Inspection depends on it too: inspectors must be able to “fully rely on the accuracy and completeness of evidence and records presented to them”.³
The regulatory consequences are serious. FDA reports that data integrity violations found in CGMP inspections have led to warning letters, import alerts and consent decrees.¹ Under PIC/S’s classification, fraud, misrepresentation or falsification of data is a critical deficiency, and a poorly designed system that only creates the opportunity for failure can still be a major or other deficiency.³
WHO lists the usual causes: reliance on inadequate human practices, poorly defined procedures, resource constraints, computerised systems that cannot meet requirements or are poorly managed and validated, poor control of data flow, and failure to review and manage original data.⁴
4Examples of data integrity failures.
FDA’s questions and answers describe practices that do not meet CGMP, and why.¹
| Practice | Why it fails |
|---|---|
| Shared login accounts | Actions cannot be attributed to an individual. |
| Writing data on scraps of paper and transcribing them later | The original is discarded; data must be recorded at the time of performance. |
| Keeping only the final result of reprocessed chromatography | Each reprocessing result must be retained for review. |
| Using actual samples as “system suitability” or trial injections | It can disguise testing into compliance. |
| Keeping a printout instead of the dynamic FT-IR spectrum file | A static printout does not preserve the complete original record. |
| Handling a tip about falsification informally | Suspected falsification must be investigated within the quality system. |
5What a data integrity programme involves.
The guidances call the controls data governance: “the sum total of arrangements which provide assurance of data integrity”.³ Effort follows risk. PIC/S asks companies to consider data criticality, the data’s influence on decisions and product quality, together with data risk: how vulnerable the data are to alteration, deletion, loss or falsification, and how likely such actions are to be detected. Its example: for an oral tablet, API assay data generally matter more than tablet friability data.³ MHRA and WHO describe a data integrity risk assessment (DIRA) that maps how each process generates data and where the risks lie.²⁴
Management owns it. FDA says management with executive responsibility should create a quality culture in which data integrity is a core value and issues are reported promptly,¹ and WHO makes senior management accountable for the data governance system.⁴ Moving from paper to electronic systems, or back, does not remove the need for controls, and automation or a validated system “may lower but not eliminate data integrity risk”, particularly where people influence what is recorded, reported or retained.² Audit trails are reviewed with the records they belong to (see audit trail review), and staff are trained to prevent and detect data integrity issues.¹
6How it runs in Seal.
In Seal, laboratory, manufacturing and quality work runs on one platform, and each record keeps its audit history and electronic signatures, with controls to support Part 11 and Annex 11. For each entry Seal keeps the user, API key or trigger behind it, the capture time, the original file and its source reference, and each change as a new version linked to the earlier ones. The data integrity blueprint shows how a vendor audit-trail export, from a chromatography data system for example, is attached and reviewed beside the record it belongs to, and how a required review can hold a result or batch disposition until it is done.
The platform shows how lab, manufacturing and quality records connect, and Regulatory and validation covers what to demonstrate about audit history and signatures during qualification.
References
- 1Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 2‘GXP’ Data Integrity Guidance and Definitions, Revision 1, MHRA, March 2018. https:/
/ assets. publishing. service. gov. uk/ media/ 5aa2b9ede5274a3e391e37f3/ MHRA_ GxP_ data_ integrity_ guide_ March_ edited_ Final. pdf (read 6 November 2026) - 3PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, PIC/S, 1 July 2021. https:/
/ picscheme. org/ docview/ 4234 (read 6 November 2026) - 4Guideline on data integrity, WHO Technical Report Series No. 1033, Annex 4, World Health Organization, 2021. https:/
/ cdn. who. int/ media/ docs/ default- source/ medicines/ norms- and- standards/ guidelines/ inspections/ trs1033- annex4- guideline- on- data- integrity. pdf (read 6 November 2026) - 521 CFR 211.68, Automatic, mechanical, and electronic equipment, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 68 (read 6 November 2026) - 621 CFR 211.100, Written procedures; deviations, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 100 (read 6 November 2026) - 721 CFR 211.180, General requirements (records and reports), eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 180 (read 6 November 2026) - 8Guidance on good manufacturing practice and good distribution practice: questions and answers, data integrity section, European Medicines Agency, undated. https:/
/ www. ema. europa. eu/ en/ human- regulatory- overview/ research- development/ compliance- research- development/ good- manufacturing- practice/ guidance- good- manufacturing- practice- good- distribution- practice- questions- answers (read 6 November 2026)
AQuestions and answers
What does ALCOA+ stand for?
Attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available. FDA’s and MHRA’s guidance use ALCOA, while PIC/S and WHO use ALCOA+, and MHRA says the expectations are the same whichever acronym is used.
Is data integrity a legal requirement or only guidance?
It is a legal requirement through the GMP regulations. In the US, 21 CFR 211 requires complete records, made at the time of performance, with secure backups and quality unit review. FDA’s data integrity guidance explains those requirements but is not itself binding. In the EU, EMA treats data integrity as part of the pharmaceutical quality system that EU GMP requires.
Does data integrity apply to paper records?
Yes. Every guidance applies the same principles to paper, electronic and hybrid records. On paper that means controlled blank forms, indelible ink, no pencil or correction fluid, and single-line corrections that show who made the change, when and why.
What is the difference between data integrity and data quality?
Data quality asks whether data are exactly what was intended and fit for their purpose. Data integrity asks whether data are complete, consistent and accurate and have stayed that way through their life cycle. MHRA points out that integrity controls alone do not guarantee good-quality data.
Who is responsible for data integrity in a company?
The manufacturer or distributor. Senior management is accountable for the data governance system and the culture that supports it, but everyone who creates, reviews or approves GxP data has a part. A company that outsources work remains responsible for the integrity of the data its contractors provide.