TL;DR
- FDA data integrity expectations focus on ensuring that regulated data remains complete, consistent, accurate, and reliable throughout its lifecycle.
- The FDA's 2018 Data Integrity and Compliance With Drug CGMP guidance explains how data integrity applies to pharmaceutical and biologics CGMP operations.
- ALCOA principles, 21 CFR Part 11, and regulations such as 21 CFR 211.68 and 211.194 provide important foundations for managing electronic and laboratory records.
- Laboratories need appropriate access controls, audit trails, metadata, review procedures, backup processes, and validated systems to protect data integrity.
Data integrity is a fundamental requirement for organizations operating in FDA-regulated life sciences environments. Pharmaceutical manufacturers, biotechnology companies, contract research organizations, and regulated laboratories must ensure that the data supporting their activities is reliable and can be reconstructed when needed.
The challenge is that scientific data is rarely generated in one place. Results may originate from laboratory instruments, spreadsheets, LIMS, electronic laboratory notebooks (ELNs), manufacturing systems, and analytical applications. Each system creates potential risks involving incomplete records, undocumented changes, missing metadata, or uncontrolled access.
The FDA addresses these risks through regulations and guidance covering electronic records, laboratory documentation, computerized systems, and current good manufacturing practices (CGMP).
Understanding these expectations helps organizations build practical controls without treating every system or data point as equally risky.
What Do FDA Guidelines Say About Data Integrity?
The FDA's primary guidance for pharmaceutical data integrity is Data Integrity and Compliance With Drug CGMP: Questions and Answers, issued in December 2018.
It explains how existing drug CGMP requirements apply to data generated and maintained throughout pharmaceutical manufacturing and laboratory operations.
The guidance defines data integrity in terms of three characteristics:
- Completeness: Relevant data and associated records are present.
- Consistency: Data remains coherent and traceable throughout its lifecycle.
- Accuracy: Records correctly represent the activities and results they document.
The FDA expects data to remain reliable throughout its lifecycle, including creation, modification, processing, maintenance, archival, retrieval, transmission, and eventual disposition.
This applies to more than final reports. Original data, metadata, audit trails, processing parameters, and relevant supporting records may all be necessary to reconstruct an activity.
Important regulatory distinction: The 2018 guidance focuses on drug CGMP, including biologics. It clarifies how existing requirements apply; it does not create a single new data integrity regulation for every life sciences organization. Other regulated activities must be evaluated against their applicable regulations and guidance.
Key FDA Regulations and Guidance Related to Data Integrity
Several FDA requirements and guidance documents are relevant to data integrity. Their applicability depends on the organization's activities, records, and regulatory obligations.
21 CFR Part 11: Electronic Records and Electronic Signatures
21 CFR Part 11 establishes criteria for electronic records and electronic signatures to be considered trustworthy, reliable, and generally equivalent to paper records and handwritten signatures.
Relevant controls include:
- Limiting system access to authorized individuals
- Maintaining appropriate operational and authority checks
- Protecting electronic records
- Using appropriate electronic signature controls
- Linking electronic signatures to their associated records
- Maintaining system documentation and accountability
Part 11 applies when electronic records and signatures fall within its scope, including certain records maintained electronically under FDA recordkeeping requirements.
FDA's Part 11 Scope and Application guidance explains the agency's interpretation and enforcement discretion for specific provisions. It does not remove applicable underlying predicate-rule obligations.
21 CFR Part 211: Drug CGMP Requirements
Part 211 contains CGMP requirements for finished pharmaceuticals. Several provisions directly support data integrity.
For example, § 211.68 addresses controls over computerized systems, including authorized changes and the maintenance of backup data. Section 211.194 requires complete laboratory records associated with testing.
These provisions matter when laboratory results, instrument outputs, and manufacturing records support regulated product decisions.
FDA Data Integrity Guidance for Drug CGMP
The 2018 guidance provides practical questions and answers about common data integrity scenarios.
It addresses topics such as:
- Electronic data and paper records
- Metadata and audit trails
- User access and system controls
- Backup and restoration
- Original records and true copies
- Data review and record retention
Organizations can use it to assess whether their procedures and technical controls adequately protect regulated records.
ALCOA and ALCOA+: Principles for Data Integrity
ALCOA is a widely used framework for understanding the characteristics of reliable data. The FDA's 2018 guidance explicitly describes these principles in its discussion of complete, consistent, and accurate CGMP records.
ALCOA+ extends this framework with additional characteristics commonly used in life sciences quality systems:
- Complete: All relevant data, including repeat tests and deviations, is retained.
- Consistent: Dates, times, sequences, and records are coherent.
- Enduring: Data remains accessible throughout its required retention period.
- Available: Records can be retrieved for review and inspection.
ALCOA+ is an industry framework, not a separately codified FDA regulation. It is useful for translating data integrity expectations into operational practices.
Why Metadata and Audit Trails Matter
A data value alone may not provide enough context to establish what happened.
For example, an analytical result of 23 mg is difficult to interpret without information about the sample, units, instrument, analyst, method, and acquisition time.
Metadata provides this context. The FDA guidance specifically discusses preserving relevant metadata and its relationship to the associated data.
Audit trails provide another important layer. They help reconstruct events involving the creation, modification, or deletion of electronic records.
For an HPLC analysis, relevant audit trail information may include the user, date and time, injection sequence, integration parameters, and details of any reprocessing.
The FDA expects organizations to maintain appropriate controls based on applicable requirements and documented risk assessments.
How to Implement FDA Data Integrity Expectations in a Laboratory
Data integrity requires coordinated procedural, technical, and organizational controls. Installing a compliant software product alone is not enough.
1. Map the Complete Data Lifecycle
Identify where regulated data is created, processed, reviewed, transferred, stored, and archived.
Include:
- Laboratory instruments and analytical software
- LIMS and ELN applications
- Manufacturing and quality systems
- Spreadsheets and manual records
- Data transfers and integrations
- Backup and archival environments
Mapping the lifecycle helps identify where data could be lost, changed, separated from its metadata, or become inaccessible.
2. Establish Role-Based Access Controls
Users should only have access appropriate to their responsibilities.
Use individual accounts rather than shared credentials. Restrict administrative privileges and control who can modify methods, specifications, results, and other regulated records.
Review access periodically and remove permissions when employees change roles or leave the organization.
3. Maintain Complete Audit Trails
Configure appropriate audit trail controls for systems that create, modify, or delete regulated electronic records.
Audit trail reviews should be defined in procedures, with clear responsibilities and escalation processes for unexplained changes.
A system that records changes but does not support meaningful review may not provide sufficient operational oversight.
4. Validate Systems for Their Intended Use
Assess computerized systems according to their intended use and potential impact on product quality, patient safety, and record integrity.
Validation should provide documented evidence that relevant functions work as intended.
For LIMS, ELN, instrument software, and integrations, consider requirements, risk assessment, testing, traceability, approvals, and change management.
See Scispot's LIMS implementation guide for additional context on implementing laboratory systems.
5. Protect Original Records and Backups
Retain original electronic data and the metadata needed to understand and reconstruct the activity.
Do not assume that a printed report or PDF is automatically a complete copy of an electronic record. Depending on the system, important information may include raw data, methods, sequences, processing parameters, and audit trails.
Test backup and restoration processes periodically. A backup is useful only if it can be recovered accurately and within the required timeframe.
6. Train Employees and Investigate Data Integrity Events
Employees should understand good documentation practices, system-specific controls, and the importance of reporting errors or unexplained changes.
When a data integrity issue occurs, investigate its scope and root cause. Assess the impact on affected records, products, studies, and decisions, then document corrective and preventive actions (CAPA).
5. How Laboratory Software Supports Data Integrity
Laboratory software can help implement data integrity controls by connecting records, enforcing workflows, preserving context, and improving traceability.
However, software capabilities must be configured, validated, and operated appropriately. No LIMS, ELN, or QMS automatically guarantees FDA compliance.
LIMS: Structured Sample and Testing Records
A Laboratory Information Management System (LIMS) can centralize sample identifiers, test assignments, results, specifications, approvals, and associated records.
Relevant capabilities include:
- Role-based access
- Controlled workflows
- Result review and approval
- Audit trails
- Sample traceability
- Integration with laboratory instruments
Explore Scispot LIMS to understand how structured laboratory workflows can support connected data management.
ELN: Traceable Experimental Records
An Electronic Laboratory Notebook (ELN) helps researchers document experiments, observations, methods, and results.
When appropriately configured, it can support:
- Attributable experimental records
- Controlled access
- Version history
- Electronic approvals
- Searchable experimental metadata
Learn more about electronic laboratory notebooks.
Integrations: Preserving Data Across Systems
Data integrity risks can increase when information moves between instruments, spreadsheets, LIMS, ELNs, and other applications.
Integration workflows should preserve relevant identifiers, metadata, timestamps, and source information. They should also include appropriate error handling, reconciliation, and monitoring.
Scispot's GLUE integration capabilities help connect laboratory instruments and applications, supporting a more unified approach to scientific data workflows.
For laboratories looking to strengthen data integrity, the objective is to make records easier to trace, review, and reconstruct across the entire data lifecycle.
