Data Integrity and Data Governance
Excerpt from the GMP Compliance Adviser, Chapter 15.H,Data integrity – general requirements in a GxP-regulated environment
4 min. reading time | by Markus Veit, PhD
Published in LOGFILE 24/2025
Data integrity is a key element in the pharmaceutical quality assurance system which has gained importance in recent years, especially from the viewpoint of the authorities. In GxP-regulated companies, managers are responsible for identifying and minimising risks to data integrity (“data governance”).
What is the importance of data integrity?
Data integrity plays a key role in the fundamental requirements that affect a pharmaceutical quality system as specified in Chapter 1 of the EU GMP Guidelines. As a result, the senior management of a pharmaceutical company must provide the necessary resources and ensure that all of the principal requirements are implemented. This also applies to all the suppliers, contract manufacturers, contract laboratories and logistics companies that work with the pharmaceutical company.
A risk-based approach also applies to data integrity!
A risk-based approach should always be taken that complies with the principles of pharmaceutical quality risk management (ICH Q9(R1)). This also includes carrying out regular evaluations to check if the actions taken are appropriate and sufficient. The criticality of the data examined during this process is very important and should be carefully evaluated. It is obvious that the data used when making a decision on batch release is more critical than data that is not directly relevant to the release, such as warehouse cleaning records.
Which measures are crucial for implementation and monitoring of data integrity?
To comply with the requirements of data integrity, suitable monitoring systems must be in place. In addition, regular personnel training on the importance of data integrity principles must be carried out. The training sessions should contribute to the creation of a working environment that promotes an open culture of reporting failures, omissions and deviating results.
What responsibilities does management have?
In GxP-controlled companies, management is responsible for implementing systems and procedures for minimising the potential risk to data integrity and to identify risks using risk-based principles ("data governance").
The PIC/S guideline PI 041-1 „Good Practices for Data Management and Integrity in Regulated GMP/GDP-Environments“ assigns clear tasks and responsibilities to senior management in this regard:
- Leadership, resource allocation and financing for the data integrity and data governance initiative within a company. This programme requires more than just an email from the CEO stating that the company will ensure data integrity from now on; rather, it requires a concerted and long-term effort.
- Creation of an open company culture, where the staff members have the opportunity to address integrity issues.
- Establishment and maintenance of a quality culture.
- Determining and maintaining the ethos and values for data integrity.
- Definition of guidelines and procedures with the corresponding training for all aspects of data integrity.
- Ensuring that assessments of processes and systems are carried out to identify and classify data vulnerabilities.
- Establishment of metrics for various data integrity activities and review by management.
- Completion of regular and sound reviews of data integrity projects.
- Establishment of a protected whistle-blower procedure to make the senior management aware of data integrity issues.
Data Integrity and Supplier qualification
Contract givers should ensure as part of supplier qualification that appropriate systems are also implemented at all of their suppliers. In the case of contract manufacturing, contract testing and contract packaging, this also includes monitoring measures and regular checks that cover the following aspects as a minimum:
- trend recording and systematic follow-up of non-compliant and deviating data as specified in the life-cycle concepts now required during pharmaceutical development, validation and monitoring of analytic procedures and manufacturing processes
- regular checks of audit trails which help detect possible deviations and situations that necessitate additional training measures
- validation and routine monitoring of computerised systems as outlined in Annex 11 of the EU GMP Guidelines