Data Integrity and Compliance With Drug CGMP: Questions and Answers (FDA guidance)

Context and history

FDA published this guidance in December 2018 as questions and answers on data integrity for drug manufacturing. It came after years of warning letters citing data integrity problems, and it explains how FDA reads existing CGMP rules. It adds no new requirements of its own: it points to parts 210, 211 and 212, and asks firms to apply risk-based thinking.

It has become a reference point for inspections worldwide, together with the MHRA, PIC/S and EMA documents on the same subject.

Who and what it applies to

Manufacturers subject to drug CGMP regulations, including drugs, biologics and veterinary products, and PET drugs under part 212.

What it contains

Introduction and background

Explains why data integrity matters, and that the guidance gives FDA's current thinking.

Q1 Terms

Clarifies data integrity, metadata, audit trail, static and dynamic records, backup, and systems in the CGMP context.

Q2 Invalidating results

When a CGMP result may be invalidated, which needs a valid documented scientific reason.

Q3 Workflow validation

Each CGMP workflow on a computer system is an intended use to validate, with the extent based on risk.

Q4 and Q5 Access

Restricting access to authorised personnel, and why shared login accounts cannot meet CGMP: a unique person cannot be identified.

Q6 Blank forms

Controlling blank forms.

Q7 and Q8 Audit trails

Those responsible for record review should review audit trails, as they would cross-outs on paper. Follow the review frequency in CGMP rules where one is set, and otherwise base it on risk.

Q9 and Q10 Copies and originals

When electronic copies are acceptable, and when printouts or static records are not enough for dynamic data.

Q11 Electronic signatures

Using electronic signatures for master records.

Q12 CGMP records

When generated to satisfy a CGMP requirement, all data becomes a CGMP record.

Q13 and Q14 Laboratory data

Using actual samples in system suitability tests, and saving only final reprocessed results.

Q15 to Q18 People and remediation

Anonymous tips, training on detecting problems, FDA's access to electronic records, and how to address problems: investigate scope and root cause, assess risk, and set a management strategy.

Key points

• CGMP data is any data generated to satisfy a CGMP requirement.
• Every CGMP workflow on a system is an intended use to validate.
• Shared logins fail CGMP, because a unique person cannot be identified.
• Record reviewers should review audit trails too.
• A printout is enough only if it is the original or a true copy, which it generally cannot be for dynamic data.
• Testing into compliance with trial injections is a concern, so keep all data.
• FDA may review electronic records during inspection.
• Remediation means scope, root cause, risk assessment and a management strategy.

In practice

General reading, not advice. This is drafted with AI and may not fit your situation. It does not replace the official text, your own quality system or qualified advice, and an inspector may take a different view.

• Remove shared accounts from laboratory instruments first, a frequent inspection finding.
• Build audit trail review into batch and data review, not as a separate exercise.
• Keep original electronic data from stand-alone instruments, not only printouts.
• Train staff on what a data integrity problem looks like, and how to raise one.

Read from the source document on 1 Nov 2026. This is our own description, not the official text. Check the full dated history in the change log below.