What Is Data Integrity in the Pharmaceutical Industry?

In short: Data integrity means pharmaceutical data stay complete, consistent and accurate through their whole life cycle, so decisions on product quality and patient safety can be trusted. This article is for QA, QC and production staff and explains the regulatory definitions, ALCOA/ALCOA+ and the principles of data governance.

Why data integrity matters

Regulatory data are now generated in many ways: paper records, electronic capture, automated equipment, remote systems and third-party service providers. Whatever the method, regulators expect the same thing. They need confidence that the data are reliable, and that the activities behind them can be reconstructed. Data integrity failures are a frequent theme in inspection findings and warning letters, for example in this FDA warning letter case.

Definitions

US FDA. In its Q&A guidance, FDA describes data integrity as the completeness, consistency and accuracy of data. Such data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA).

MHRA (UK). MHRA defines data integrity as the degree to which data are complete, consistent, accurate, trustworthy and reliable, and that these qualities are maintained throughout the data life cycle. Reaching this needs suitable quality and risk management systems, sound science and good documentation practices.

ALCOA and ALCOA+

Letter	Meaning	In practice
A	Attributable	Shows who did what, and when
L	Legible	Readable and permanent
C	Contemporaneous	Recorded at the time the work is done
O	Original	First recording (source or primary data), or a certified true copy
A	Accurate	Error-free, truthful, reflects the observation

ALCOA+ adds complete, consistent, enduring and available. MHRA notes that expectations are the same whichever acronym is used, because data governance should ensure all of these qualities across the data life cycle.

Key terms

Raw data: the original records, kept in the form in which they were generated (paper or electronic), or a true copy.
Data life cycle: all phases from generation and recording, through processing, use, retention and archiving, to destruction.
Audit trail: a secure, computer-generated record of who changed what, when and why, linking any electronic signature to its record.
Metadata: data that describe other data, such as time stamp, user and instrument settings.

Principles of data governance (MHRA, paraphrased)

Management owns it. The organisation is responsible for its systems and the data they generate. Culture and senior management behaviour strongly affect success, and the data governance policy should be endorsed at the top.
Right environment. People, systems and facilities should be arranged so that data integrity controls can work.
Risk-based. Controls should match the risk to patient and product. A common method is a data integrity risk assessment that maps processes, data formats, criticality and inherent risks.
No routine forensic checking. Organisations are not expected to check all data forensically, but periodic audits should be able to detect weak points.
Paper or electronic. Moving from computerised to manual systems, or the reverse, does not remove the need for controls.
Fix systemically. Where weaknesses are found, corrective and preventive actions should cover all relevant systems, not one in isolation. Significant incidents should be reported to the authorities as required.

Practical checks in a data integrity verification (summary)

An internal data integrity check, run during self-inspection, typically looks for:

entries made at the time of the activity, with no back-dating or pre-dating
legible, permanent entries and no unauthorised overwriting
signatures matching specimen signatures, and times matching attendance
unique user IDs, password control, secure backups and no mismatch between saved and printed data
no unofficial notes (scrap paper) and no discarded microbiology plates without recorded results

Findings go to the department head for investigation, impact assessment and CAPA, tracked by QA. For a full example procedure, see SOP on data integrity.

Frequently asked questions

What does ALCOA stand for?

Attributable, Legible, Contemporaneous, Original and Accurate.

What is the difference between ALCOA and ALCOA+?

ALCOA+ adds complete, consistent, enduring and available. Regulators expect all of them either way.

Does data integrity apply to paper records?

Yes. It applies equally to paper and electronic data.

What is an audit trail?

It is a secure record of creation, change or deletion of data, showing who, when and why, which supports reconstruction of events.

References

MHRA, ‘GXP’ Data Integrity Guidance and Definitions, Revision 1, March 2018.
US FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, December 2018.
WHO, Technical Report Series No. 1033, Annex 4: Guideline on data integrity (2021).
PIC/S, PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (2021).
European Commission, EudraLex Volume 4, Annex 11: Computerised Systems (January 2011 revision; a revised draft went to public consultation in 2025 — check EudraLex Volume 4 for its adoption status).