FDA data integrity guidance: the 2018 Q&A, question by question

The guidance has one current version. FDA published a draft in April 2016 under the title “Data Integrity and Compliance With CGMP”, revised it after comments, and announced the final guidance in the Federal Register on December 13, 2018 (83 FR 64132). FDA's guidance list, read on 2026-10-28, still shows the December 2018 text as the final one: searches for a 2020 or 2022 edition find the same document. One newer FDA guidance carries data integrity in its title, a draft for bioavailability and bioequivalence studies.

FDA states its purpose as “to clarify the role of data integrity in current good manufacturing practice (CGMP) for drugs, as required in 21 CFR parts 210, 211, and 212.” CGMP there includes biologics, and for active pharmaceutical ingredients FDA says its requirements are consistent with ICH Q7. It was not written for device makers, GLP studies or clinical trials, which have their own texts; the overview of GxP sorts out which applies to you.

FDA gives its reason in the background section: “In recent years, FDA has increasingly observed CGMP violations involving data integrity during CGMP inspections,” and those violations “have led to numerous regulatory actions, including warning letters, import alerts, and consent decrees.” It gives no count there, and neither do we. The approach it asks for is risk-based: firms should have “meaningful and effective strategies” built on their process understanding, with management involved.

Electronic records and signatures sit beside it, not inside it. The Q&A says those requirements “are laid out in 21 CFR part 11” and points to the 2003 Scope and Application guidance; whether a given record falls under Part 11 is what the Part 11 applicability checker answers, and what 21 CFR Part 11 is and who it binds covers the rule.

The guidance numbers its questions 1 to 18, with question 1 split into six definitions. Filter by area, or read straight down. Each number links to the part of this page that walks its area.

Question 1 is a glossary, and the rest of the guidance leans on it. Two of its terms have pages of their own here; the other four are short enough to take in one pass.

Data integrity. “The completeness, consistency, and accuracy of data”, where complete, consistent and accurate data is attributable, legible, contemporaneously recorded, original or a true copy, and accurate: ALCOA. FDA stops at those five. The four extra attributes most quality manuals carry come from PIC/S, and the ALCOA+ principles of data integrity page shows each one on paper, in a system and in a spreadsheet. FDA's footnote ties each attribute to sections of parts 211 and 212, so ALCOA here sums up rules that already exist rather than adding a new one.

Metadata and audit trail. Metadata is the context that makes a value mean something, and the audit trail is the record of every create, change and delete. FDA wants both kept with the data for the whole retention period, with the link between data and metadata “preserved in a secure and traceable manner”. What a trail must hold, and how to tell metadata from trail, is set out in what an audit trail is in GxP.

Static and dynamic. A static record is fixed, like paper or an image. A dynamic one lets the user interact with it: FDA's examples are a chromatogram whose baseline can be moved and reprocessed, and a spreadsheet whose formulas can be edited. The difference decides Q9 and Q10 below, and it is why a spreadsheet that computes a result is a record to control, not a calculator (see Excel spreadsheets under Part 11).

Backup. In § 211.68(b), a backup is “a true copy of the original record that is maintained securely throughout the record retention period”, with its metadata, in the original format or one compatible with it. A temporary copy made in case of a crash does not count. FDA notes this is what its software validation guidance calls an archive.

Systems. The “computer or related systems” of § 211.68 are wider than the software: hardware, peripherals, networks, cloud infrastructure, personnel and documents such as user manuals and SOPs. A hosted system is still your system under this definition; the Part 11 guide to cloud and SaaS systems covers what to ask the vendor.

Five answers are about what a QC lab keeps. Read together, they say one thing: every result produced to meet a CGMP requirement stays in the record, including the ones you would rather not report.

Q12, when data becomes a record. “When generated to satisfy a CGMP requirement, all data become a CGMP record.” Chromatographic data should be saved “upon completion of each step or injection”, not at the end of the injection set, and aborted or incomplete injections should be in the audit trail and investigated. Scrap paper that is thrown away after transcription is “not acceptable”. FDA names the fix for systems: a LIMS or an electronic batch record that saves after each entry, plus a procedure that data is keyed in when it is generated.

Q2, invalidating a result. A result can be left out of the batch decision only with “a valid, documented, scientifically sound justification”, and even then the batch record that goes to the quality unit holds the original data with the investigation report. FDA adds that paper and electronic records are “subject to the same requirements”.

Q14, reprocessing. Saving only the final reprocessed result is not acceptable. Reprocessing follows written procedures and “each result” is retained for review. FDA also says reprocessing “should not be regularly needed” for most analyses, so a method that is reprocessed often is worth investigating. The chromatography data system comparison reads vendors on exactly these controls.

Q10, printouts. A printout from a pH meter or a balance can be the original record, and then the printout or a true copy is kept. A dynamic file cannot be swapped for one: FDA's example is an FT-IR spectral file, which “is dynamic and can be reprocessed”, and a printout of it would not meet § 211.180(d). If the printout does not show the full spectrum, FDA adds, “contaminants may be excluded.” Both kinds of record get second-person review under § 211.194(a)(8).

Q13, system suitability. FDA has cited this in warning letters because, in some cases, actual samples run as “system suitability” tests have been “used as a means of testing into compliance”. If an actual sample is used, it should be a properly characterized secondary standard from a different batch than the samples being tested, under a written procedure.

Nine answers are about the systems that hold CGMP data and the records they produce. Two of them, who reviews audit trails (Q7) and how often (Q8), are walked step by step in the audit trail review checklist; the rest are here.

Q3, validate the workflow. Each CGMP workflow is an intended use to check through validation, and “the extent of validation studies should be commensurate with the risk”. FDA's example: qualifying a manufacturing execution system shows the platform meets its specifications, but not that a master production and control record built in it carries the right calculations. That second proof is workflow validation. Where one system runs CGMP and non-CGMP work, assess how the second could affect the first. Computer system validation for small labs lays out the lifecycle that produces this evidence.

Q4 and Q5, access. Only authorized people may change records or enter lab data (§ 211.68(b)), and FDA recommends limiting by technical means where possible, through permissions rather than policy alone. The system administrator role “should be assigned to personnel independent from those responsible for the record content”, and each system needs a documented list of who holds which privileges. Shared logins fail because no one person can be identified (the audit trail failures table shows both settings in a lab); a shared read-only account is acceptable for viewing data, never for an action such as a second-person review that must be attributable to one person.

Q6, blank forms. Paper controls still count. FDA names bound, paginated notebooks stamped by document control as good practice, because a missing page or an unofficial notebook shows. Blank forms, electronic worksheets included, should be controlled by the quality unit or another document control method, issued in numbered sets and reconciled; a spoiled form stays in the record with the reason it was replaced.

Q9, electronic copies. An electronic copy is a true copy if it preserves “the content and meaning of the original record”, all the metadata needed to reconstruct the activity, and whether the original was static or dynamic. A dynamic record can be copied into another format only if a reader for that format is readily available.

Q11, electronic signatures. E-signatures with appropriate controls can replace handwritten signatures or initials “in any CGMP required record”, even where § 211.186(a) asks for a “full signature, handwritten”, because Part 11 (§ 11.2(a)) makes the controlled e-signature the equivalent. Firms should document the controls that identify who signed. The signature manifestation check tests what a signed record shows.

Q17, inspection. FDA may review every record required under CGMP, on paper or in a system, including electronic communications that support CGMP work. FDA's example is an email authorizing batch release. Copying electronic data for the inspector is part of allowing inspection (§ 211.180(c)).

The guidance opens with management, not software: it is “the role of management with executive responsibility to create a quality culture” in which staff see data integrity as a core value and report issues promptly. Three answers put that into practice.

Q15, internal tips. Suspected or known falsification is investigated under the CGMP quality system, “regardless of intent or how or from whom the information was received”, to find its effect on patients, product and data reliability, its root cause and the corrective actions. A quiet word with the analyst does not close it.

Q16, training. Training people to prevent and detect data integrity issues belongs in routine CGMP training, under the personnel rule § 211.25. A training record per SOP is where that shows.

Q18, remediation. When problems are found, FDA wants to see an investigation of their scope and root causes, “a scientifically sound risk assessment” of their effects, including on data used in submissions, and a management strategy with “a global corrective action plan that addresses the root causes”. FDA lists what that may include: a third-party auditor, removing the people responsible from positions where they can influence CGMP or application data, better quality oversight and computer systems, an anonymous reporting system, and data governance officials and guidelines. FDA says these expectations mirror its Application Integrity Policy.

US drug firms that also supply Europe, or that are audited by European customers, meet three more texts. They cover the same ground as FDA's Q&A, with a different reach and their own wording.

The practical difference is reach. FDA's Q&A is drug CGMP only; MHRA's guidance spans GLP to pharmacovigilance, and PIC/S adds the four ALCOA+ attributes FDA does not list. Where Annex 11 applies, it asks for audit trails “based on a risk assessment” and their regular review, both covered in the guide to EU Annex 11.

Guidance quoted from FDA; regulation text from the eCFR; EU, UK and PIC/S texts from their publishers. General information, not regulatory advice.

1. Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry (December 2018), page and PDF, FDAread 2026-10-28
2. Data Integrity and Compliance With Drug CGMP: Questions and Answers; Guidance for Industry; Availability, 83 FR 64132 (December 13, 2018), Federal Registerread 2026-10-28
3. Data Integrity for In Vivo Bioavailability and Bioequivalence Studies (draft guidance, April 2024), FDAread 2026-10-28
4. Part 11, Electronic Records; Electronic Signatures — Scope and Application (2003 guidance), FDAread 2026-10-22
5. Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 2024), FDAread 2026-10-22
6. 21 CFR Part 211, CGMP for Finished Pharmaceuticals, eCFRread 2026-10-22
7. 21 CFR Part 58, Good Laboratory Practice for Nonclinical Laboratory Studies (§ 58.130(e)), eCFRread 2026-10-22
8. PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (1 July 2021), PIC/Sread 2026-10-22
9. Guidance on GxP data integrity (March 2018, updated September 2021), MHRAread 2026-10-22
10. EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22