Pharmaceutical Guidelines
Search

Data Processing in QC Lab Equipment: GMP Requirements

Last reviewed 27 Oct 2026 · 5 min read

Contents
  1. Which systems are covered
  2. What WHO expects
  3. What EU GMP Annex 11 adds
  4. What US FDA expects
  5. Putting it into practice
  6. Frequently asked questions
  7. Related reading
  8. References

In short: Any computer, instrument software or spreadsheet that collects, processes, records, reports, stores or retrieves QC test data must be fit for purpose, protected from unauthorised access, change-controlled and backed up. This page summarises what WHO, EU GMP and US FDA expect, for QC analysts, reviewers and QA staff.

Which systems are covered

Chromatography data systems (CDS), spectrophotometer and balance software, dissolution and titration software, LIMS and electronic laboratory notebooks, and spreadsheets used for calculations are all “data-processing equipment”. The same expectations apply whether the system is a stand-alone PC beside an instrument or a networked server.

What WHO expects

The WHO good practices for pharmaceutical quality control laboratories (TRS 1052, Annex 4, 2024) say the quality manager should ensure that, for test data in computerised systems:

  • electronic data are protected from unauthorised access, and an audit trail is enabled, maintained and periodically checked;
  • software developed by the user is documented in enough detail and validated or verified as suitable for use;
  • computers and automated equipment are maintained and kept in the environmental and operating conditions needed to protect data integrity;
  • electronic data are backed up at appropriate regular intervals, are retrievable and are stored so as to prevent loss (section 3.34).

Related paragraphs in the same section ask for:

  • a validation master plan for information systems (3.30);
  • an SOP covering use of the LIMS or recording system, access rules, and backup type, frequency and restoration (3.30);
  • validation of electronic forms built on commercial software such as Excel (3.35);
  • controlled, validated changes to software configuration (3.32);
  • individual login and password for every user (3.33).

What EU GMP Annex 11 adds

EU GMP Annex 11 (Computerised Systems, revision 1, in operation from 30 June 2011) applies to every computerised system used in GMP activities. Key clauses for the QC lab:

Annex 11 clauseExpectation
1Risk management over the whole life cycle, covering patient safety, data integrity and product quality
4Validation: application validated, IT infrastructure qualified, user requirements traceable, data-migration checks
6Extra check on critical data entered manually (second person or validated electronic means)
7Data protected physically and electronically; regular backups; restoration tested and monitored
9Risk-based audit trail of GMP-relevant changes and deletions, with reason documented; regularly reviewed
10Changes and configuration only under a defined procedure
11Periodic evaluation that the system remains validated and compliant
12Access limited to authorised persons; creation, change and cancellation of access recorded
16 and 17Business continuity and archiving, with data retrievable after system changes

What US FDA expects

21 CFR 211.68 requires that computers and related systems are routinely calibrated, inspected or checked under a written programme, that only authorised people can change master or other records, that input and output are checked for accuracy, and that a backup of entered data is kept. 21 CFR 211.194(a) requires laboratory records to hold the complete data derived from all tests, including graphs, charts and spectra from laboratory instruments and all calculations.

The FDA guidance Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018) explains how these rules are read. Points most relevant to QC:

  • data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA);
  • access to CGMP systems should be restricted, and shared login accounts are a concern because actions cannot be attributed to one person;
  • audit trails are part of the record and should be reviewed by the people responsible for record review, as they review the rest of the record (questions 7 and 8);
  • backup data must be exact and complete and kept secure from alteration, inadvertent erasure or loss (21 CFR 211.68(b), as quoted in the Q&A).

Putting it into practice

The following are typical controls in a QC lab. Frequencies and details are example in-house criteria; set yours from a documented risk assessment.

  1. Inventory and classification. List every system that creates or processes GMP data, with owner and criticality.
  2. Validation. Write user requirements, test the configured system, and validate spreadsheets (locked formula cells, tested calculations, version control).
  3. Access control. Individual user accounts; roles separate analyst, reviewer and administrator; analysts cannot delete data or change system time.
  4. Audit trail. Enable it, keep it from being switched off by analysts, and review it with the raw data before results are approved (for example, for every batch’s chromatograms).
  5. Change control. Software updates, method or processing-parameter changes and integration changes go through change control with re-qualification where needed.
  6. Backup and restore. Automatic scheduled backups, a stored copy away from the original server, and a periodic restore test to prove the data can be read back.
  7. Maintenance and environment. Computers and instruments kept in conditions specified by the supplier; clocks synchronised.
  8. Retention. Raw electronic data and metadata are kept at least 1 year after the expiry date of the respective product batch (EU GMP Part I Chapter 4 section 4.11, or 5 years after QP certification if longer; 21 CFR 211.180(a)), and longer if local law or the marketing authorisation requires. They must stay readable for the whole period.

Frequently asked questions

Is a printout enough if the data are electronic? It depends on the record. A printout can be the original record for simple instruments such as some balances and pH meters, but for dynamic electronic records that can be reprocessed (for example chromatography or FT-IR files) a printout does not preserve the complete original record (FDA Q&A, December 2018, question 10). Annex 11 clause 8 also expects clear printed copies to be obtainable.

Do we need to validate Excel sheets? Yes, if they are used for GMP calculations or records. WHO TRS 1052 Annex 4 (3.35) asks for validation of electronic forms prepared from commercial software, described in a validation report.

Why are shared logins a problem? Because the audit trail cannot show who did what, so the data are not attributable.

How often should backups be tested? Annex 11 clause 7.2 says the ability to restore data should be checked during validation and monitored periodically; the interval is a risk-based decision documented in your SOP.

References

  1. WHO Technical Report Series No. 1052 (2024), Annex 4: WHO good practices for pharmaceutical quality control laboratories, sections 3.30 to 3.37.
  2. European Commission, EudraLex Volume 4, Annex 11: Computerised Systems, revision 1 (in operation from 30 June 2011).
  3. US FDA, 21 CFR 211.68 (automatic, mechanical and electronic equipment), 211.180 and 211.194 (laboratory records).
  4. US FDA, Guidance for Industry: Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018).
  5. EU GMP Part I, Chapter 4: Documentation, section 4.11.

Related articles