Data Integrity and Compliance with cGMP Guidance for Industry according to FDA

In recent years, FDA has increasingly focused on data integrity.  The cGMP violations involving data integrity has increased during inspections.  This is a negative trend because ensuring data integrity is an important component of the industry’s responsibility to ensure the safety, efficacy and quality of drugs and FDA’s ability to protect the public health.

The data integrity – related cGMP violations have led to numerous regulatory actions, including warning letters, important alerts and consent decrees.

Requirements with respect to data integrity in parts 211 and 212, among other things, include:

• Backup data are exact and complete, secure from alteration, inadvertent erasures or loss
• Data is stored to prevent deterioration or loss
• Activities are document at the time of performance
• Records are retained as original records, true copies
• Complete information, complete data derived from all tests,

Electronic signatures and record-keeping requirements are laid out in 21 CFR part 11.

What is Data Integrity?

Data integrity refers to the completeness, consistency and accuracy of data.  Data should be attributable, legible, contemporaneously recorded, original, accurate, complete, consistent, enduring and available (ALCOA+).

What is Metadata?

Metadata is contextual information required to understand data.  A data value is by itself meaningless without additional information about the data.  Metadata is often described as data about data.  Metadata is structured information that describes, explains or otherwise makes it easier to retrieve, use or manage data.

Among other things, metadata for a particular piece of data could include a date/time stamp for when the data were acquired, a user ID of the person who conducted the test or analysis that generated the data, the instrument ID used to acquire the data, audit trails, etc

Data should be maintained throughout the record’s retention period with all associated metadata required to reconstruct the cGMP activity.  The relationships between data and their metadata should be preserved in a secure and traceable manner.

What is an audit trail?

Audit trail means a secure, computer-generated, time-stamped electronic record that allow for reconstruction of the course of events relating to the creation, modification or deletion of an electronic record.  An audit trail is a chronology of the “who, what, when and why’ of a record. Electronic audit trails include those that track creation, modification or deletion of data such as processing parameters and results and those that track actions at the record of system level such as attempts to access the system or rename or delete a file. cGMP-compliant record-keeping practice prevent data from being lost or obscured.  Electronic record-keeping systems, which include audit trails, can fulfill these cGMP requirements.

What means ‘static’ and ‘dynamic’ related to record formats?

A static record is used to indicate a fixed-data document such as a paper record or an electronic image.  A dynamic record means that the record format allows interaction between the user and the record content.

What is a backup?

A backup is a true copy of the original data that is maintained securely throughout the records retention period.  The backup file should contain the data which includes associated metadata and should be in the original format or in a format compatible with the original format. This should not be confused with backup copies that may be created during normal computer use and temporarily maintained for disaster recovery.  Such temporary backup copies would not satisfy the requirement to maintain a backup file or data according to paragraph 211.68.

When does electronic data becomes a cGMP record?

All data generated to satisfy a cGMP requirement becomes a cGMP record.  Data must be documented or saved at the time of performance to create a record in compliance with cGMP requirements.  It is expected that the process is designed so the quality data that is created and maintained cannot be modified.

It is not acceptable to record data on pieces of paper that will be discarded after the data are transcribed to a permanent laboratory notebook.  Similarly, it is not acceptable to store data electronically in temporary memory, in a manner that allows for manipulation, before creating a permanent record.  Electronic data that are automatically saved into temporary memory do not meet cGMP documentation or retention requirements.

A combination of technical and procedural controls to meet cGMP documentation practices for electronic systems may be employed.  For example, a computer system such as a LIMS or EBR system can be designed to automatically save after each separate entry. This would be similar to recording each entry contemporaneously on paper batch record to satify cGMP requirements The computer system could be combined with a procedure requiring data be entered immediately when generated.