Data integrity also contributes to more efficient and effective manufacturing processes and is essential for enabling ethical and effective decision-making and assuring the development of safe and effective drugs.
Failure to comply with data integrity regulations can also have serious consequences for drug makers, such as issuance of warning letters, imposition of sanctions and fines, import bans, required product withdrawals, and even plant shutdowns.
With increasing digitalization of the pharmaceutical industry and generation of vast quantities of data, regulators are increasing their expectations regarding data integrity, with most following the ALCOA++ principles: Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available, and Traceable.
Common data integrity violations include inaccurate documentation of data, lack of investigation of critical deviations, incomplete/missing records, human errors due to the use of manual processes and paper-based systems, insufficient audit trails, lack of proper system validation, and lack of change control.
A quality culture throughout the organization, central data management platforms, continuous digital validation that operationalizes each ALCOA++ attribute, and appropriate training are all essential to assuring data integrity.
Importance of Data Integrity
Data gathered during pharmaceutical development and manufacturing activities provides a record of not only the quality and performance of drug candidates and approved drug products but documentation of regulatory compliance across the full development and commercialization life cycle.1–3 Data integrity also contributes to more efficient and effective manufacturing processes4 and is essential for enabling ethical and effective decision-making.3 Maintaining accurate, precise records — both paper and digital — in a manner that prevents errors, discrepancies, and manipulation of data is therefore essential to ensuring safety and efficacy.5
Failure to comply with data integrity regulations can also have serious consequences for drug makers, including both sponsors and contract development and manufacturing organizations (CDMOs).6 Health authorities can impose sanctions and/or fines/penalties, require products to be withdrawn from the market, even halt facility operations, and even take legal action. Such actions often lead to loss of patient trust and credibility with healthcare professionals. Notably, data integrity failures account for a significant percentage of citations by regulatory bodies. From 2014 to 2018, approximately 50% of all inspection observations (form 483s) issued by the U.S. Food and Drug Administration’s (FDA’s) Center for Drug Evaluation and Research (CDER) included citations for data integrity violations. During that same period, nearly four-fifths of all warning letters mentioned data integrity issues.
7
Evolving Regulatory Expectations
Regulatory authorities expect data to be complete, accurate, reliable and consistent, with data integrity achieved using appropriate systems and controls designed to minimize the risk of errors, omissions, and manipulation of data across all development phases and the lifetime of the data. As the pharmaceutical industry has become increasingly digitalized, regulations have evolved to ensure data integrity even for data created and stored electronically. Regulators are also paying more attention to compliance with data integrity expectations given the growing number of inspections uncovering data integrity violations.8
Recently, both the European Commissions and the FDA have updated regulations and guidance that address data integrity.8,9 The biggest changes have come from the EU, which issues the Revision of Good Manufacturing Practice (GMP) Guidelines Chapter 4 (Documentation), Annex 11 (Computerized Systems), and the New Annex 22 (Artificial Intelligence).10 The revisions to Chapter 4 clarified requirements for management of electronic records and signatures through improved governance, metadata control, and system integration. The changes to Annex 11 increase requirements for data and IT system security and controls, including audit trails. The new Annex 22 established requirements for artificial intelligence model development, including training data quality.
The FDA’s data integrity expectations are outlined in 21 CFR Part 1111 and FDA’s 2018 cGMP Data Integrity Guidance.12 In 2025, the FDA’s CDER focused on the influence of organizational culture on data integrity and the importance of effective oversight of supplier data traceability, established increased expectations for audit trails and preservation of metadata, and made it clear data systems must always be inspection-ready.9 The agency also introduced AI tools for identifying high-risk inspection targets, which require facilities to have data transparency and integrity and emphasized the importance of resilient data systems, which can be achieved through effective data governance. In early 2026, the FDA introduced the 2026 Quality Management Maturity (QMM) Prototype Assessment Protocol Evaluation Program, which includes data governance as an important topic in quality management.13
Other relevant guidance documents include the International Council for Harmonization (ICH): Guidance Q9: Quality Risk Management in Data Systems,14 ISPE GAMP 5 Guide: A Risk-Based Approach to Compliant GxP Computerized Systems,15 and the World Health Organization (WHO) Technical Report Series: Guidance on Good Data and Record Management Practices.16
Overall, data integrity is accomplished by following the ALCOA++ framework, which is fundamental to the FDA, EU, and World Health Organization (WHO) requirements for data integrity.5 ALCOA stands for attributable, legible, contemporaneous, original, and accurate, and since its first introduction, other attributes have been added to comprise the ALCOA++ concept, including complete, consistent, enduring, available, and traceable. Following Good Documentation Practices (GDP) is also important.3
Information must be readily available to authorized users and regulators. Who entered each piece of data and when must be kept by using individual login credentials. Records must be readable for as long as they are retained and time stamped in chronological order when any activity with the data occurs. All original (raw) data must be maintained and be accurate and complete (including for failed runs, odd results, etc.) without unauthorized changes or deletions. Complete audit trails must also be prepared and retained through the life of the data.
Personnel training on data integrity requirements is essential to ensuring full compliance.6 Each employed must be capable of property entering, maintaining, and protecting data. Training should also cover inspection readiness. Supplier oversight is another crucial element. Supplier qualification must include evaluation of data integrity practices and confirmation of data on certificates of analysis.
Common Data Integrity Issues
Even with well-established regulatory frameworks that lay out specific steps to be taken to ensure data integrity, violations occur frequently during pharmaceutical inspections. In part, this trend can be attributed to the larger and larger quantities of data being generated as the pharma industry becomes increasingly digitized. The larger amount of data has led regulatory bodies to increase their expectations for record generation, storage, monitoring, and use.1
Several data integrity violations appear fairly regularly. According to a Deloitte study of FDA warning letters, the four top violations relate to inaccurate documentation of data, lack of investigation of critical deviations, insufficient data access controls, and lack of contemporaneous data recording. Siloing of data and lack of interconnectivity of different digital systems are key issues because they prevent easy access for reporting and analysis and lead to significant time wasted searching for and moving data.
Other frequent data integrity challenges include incomplete/missing records, human errors due to the use of manual processes and paper-based systems, insufficient audit trails, lack of proper system validation, and lack of change control.2
All of these failures can be classified as system design flaws, process design flaws, or lack organizational issues.5 The vast majority are “structural” in nature and not deliberate. Even actions such as backdating entries and delaying documentation typically result from cultural norms and pressures.
Newer issues have arisen as the rate of digitalization and use of AI and other advanced technologies.3 Cybersecurity threats must be managed, and the potential for using AI-generated outputs containing incorrect or falsified data must be minimized. Governance frameworks are therefore receiving greater scrutiny with aspect to both of these risks.
Selected Recent Regulatory Notifications
Common data integrity violations leading to warning letters, import bans, and required corrective actions at both small and large pharmaceutical companies and CDMOs around the world have included deletion of data, clearly missing data (inadequate records), insufficient audit trails, the existence of shared logins for data access, inconsistent experimental results, and possible data fabrication. The main causes leading to these data integrity failures have included insufficient employee training and system controls, cost and time pressures, and lack of an effective quality culture.3
A few recent regulatory notifications made over the last three years include:17–20
Inadequate data integrity in the microbiology laboratory at Sichuan Deebio Pharmaceutical Co. Ltd, including non-contemporaneous documentation
Lack of data to support daily sterility assurance at Amman Pharmaceutical Industries of Jordan
Lack of evidence indicating completion of corrective actions required by S & J International Enterprises Public Company Limited to bring it into cGMP compliance
Unacceptable studies conducted by Raptim Research Pvt. Ltd., and Synapse Labs Pvt. Ltd.,
Falsification of critical manufacturing records at a Dabur India plant
Inaccurate records and inadequate controls of IT systems at Mexico-based Laboratorios Jaloma S.A.
The Solution: Quality Culture Backed by Central Data Management and Digital Validation
Successful assurance of data integrity starts with establishing a quality culture throughout the organization that incorporates quality aspects in all daily activities. Effective data governance cannot be achieved unless all employees are committed to placing quality first. Appropriate IT systems that include central data management and a mechanism for continuous digital validation that operationalizes each ALCOA++ attribute, and comprehensive employee training on ALCOA++ principles and reporting expectations enable implementation.5
Effective data integrity assurance starts with senior management, who are responsible for establishing and maintaining both the right organizational culture and technical solutions needed to withstand time and cost pressures.5 Procedures for achieving data integrity must also be outlined, beginning first with data life cycle mapping and creation of role-based logins that ensure users cannot manipulate their own records. Centralized, cloud-based storage of encrypted data, a mechanism for clear tamper-evident audit trail generation and validation of computer systems are equally essential.
Centralized data management platforms bring all manufacturing data across different machines and data historians into one system, allowing much more effective data management and integrity assurance, as well as creating opportunities for improved data analytics.1 Validation of computer systems according to GAMP 5 guidelines, meanwhile, ensures ongoing high performance in a compliant manner.3
Digitalization Continues to Drive Growing Data Integrity Demands
Going forward, continued digitalization of the pharmaceutical industry and a move toward data-centric operations across all aspects of drug development and manufacturing, including compliance, will continue to place pressure on both regulatory agencies and pharmaceutical companies to ensure the integrity of their data.21 Use of AI in process development and control, document generation, and other quality-related applications will create further need for vigilance.
An additional challenge for the industry as a whole is the need for employees working in the discovery, development, and analytical laboratories and on the plant for to be more than experts in their scientific, technical, engineering, and operational fields. Today they must also be data management specialists as well. Expanded training and infrastructure, such as manufacturing execution systems and ERP platforms, and their interatom and standardization are thus needed to support the data-driven pharmaceutical environment.
