Evolving regulatory expectations demand robust data management frameworks that align digital systems with compliance mandates. Yet many laboratories rely on outdated architectures, fragmented storage, and inconsistent supplier practices that expose critical gaps in oversight and traceability. Without a unified approach, maintaining integrity across systems and partners becomes increasingly complex.
This guide explores how modern system design and supplier governance can reinforce compliant data practices while improving operational resilience.
Download this guide to discover tips on:
- Replacing legacy systems lacking audit trails
- Implementing secure database-driven data storage
- Managing software as a service risks and supplier compliance
1
How To Achieve Data Integrity
Through Effective Data Management
in a Regulated Laboratory:
Systems and Suppliers
Mahboubeh Lotfinia and Bob McDowall, PhD
This guide discusses the role of effective (and compliant) data management (DM) in achieving data integrity
(DI), together known as DMDI.1 The first guide in this series focused on digitalization for effective DMDI.
This guide discusses DMDI in the context of systems and suppliers.
The following DM tips included in this guide can be classified into two areas:
1. Laboratory data systems
2. External service providers
Figure 1 shows the 11 tips for effective DM. The tips related to laboratory data systems and external service
providers are discussed in further detail in the following sections of this guide.
Figure 1: Top data management tips for ensuring data integrity. Credit: Bob McDowall.
Tips for effective data management
External service
providers
SaaS: the
10. validation treadmill
Handling CRO
11. & CDMO suppliers
9. No USB devices
Laboratory
data systems
Data acquisition
5. at source
Purchase GXP
6 compliant software
Databases
7. not directories
Direct data acquisition
8. to the network
Process
digitalization
Data acquisition
1. at source
Instrument
2. interfacing
Electronic
3. data transfer
Know where
4. the data go
How To Guide
HOW TO ACHIEVE DATA INTEGRITY THROUGH EFFECTIVE DATA MANAGEMENT IN A REGULATED LABORATORY: SYSTEMS AND SUPPLIERS 2
Laboratory data systems
Replace legacy and hybrid systems
PIC/S PI 041 notes that there are several vulnerabilities with legacy and hybrid systems in meeting basic
DMDI requirements, including poor configuration settings, no audit trail, inadequate user access and privileges,
and system security.2 Consistently, WHO guidelines3–5 and PIC/S PI 0412 encourage replacement of
these legacy and hybrid systems.
A critical example within legacy systems is the lack of audit trail functionality. Although PIC/S PI 041
permits a paper-based alternative,2 this is an inadequate solution, and the replacement of legacy systems
with no audit trail functionality needs to be prioritized urgently.
Purchase GxP-compliant software
When replacing a hybrid or legacy system, ensure that the selected supplier understands how to interpret
and implement any applicable GxP regulations and guidance documents. Supplier assessment
should include:
• Evaluation of software development and testing, including how software versions are released
and supported
• Treat supplier “validation” certificates with extreme caution: see preamble comment 65 to 21 CFR 11
for further information6
• Critical assessment of all technical controls for compliance and ensuring DI within an application
• GxP awareness training should be given to all personnel, including software developers with checking
of understanding: can your suppliers demonstrate this fundamental requirement?
All these elements should enable effective laboratory digitalization and compliance with ALCOA++ criteria.
The architecture of the system is important and is discussed next.
Databases not directories
Poor system design and architecture, where data is stored in directories in the operating system, must be
avoided. Files are vulnerable in directories if not protected, and audit trails are ineffective in these systems.
Do not purchase file-based systems.
Moving from file-based storage to a network database solution enables secure DM. The key advantage
is to prevent unauthorized deletion of data, including contextual metadata. Database storage also offers
effective audit trails for tracking any data changes. However, just having data stored in a database means
that functionality must be designed for efficient audit trail review, and the ability to archive and retrieve
data simply and efficiently is critical.
Using a scientific data management system can be considered as an interim solution for the purpose of
data storage only. However, as a more robust approach, you should move to a database integrated within
the application that provides superior compliance features, e.g., audit trail searchability, data analytics,
and trending.7
How To Guide
HOW TO ACHIEVE DATA INTEGRITY THROUGH EFFECTIVE DATA MANAGEMENT IN A REGULATED LABORATORY: SYSTEMS AND SUPPLIERS 3
Data acquisition to network storage
Too many laboratory systems are designed to work in standalone mode, where the users are responsible
for backup. A workstation has poor resilience and can suffer from failure of key components, e.g., disk
controllers, CPU (central processing unit), and disk drives. Data that are in a single standalone location
are not easily shared. Furthermore, laboratory users responsible for data backup won’t do this consistently.
8 One consideration for data acquisition to a network is a supplier’s service engineer: they should be
allowed access via a restricted account to perform service and requalification so that the data are stored
on the system, not a separate laptop.9
Backup is critical for disaster recovery. No backup—no disaster recovery. Ensure the IT department is
tasked with backup and with quality oversight—hence data acquisition to the network.
Designing systems with the option to acquire data directly to a secure and resilient network storage location
is ideal. Data from one analysis can then be reviewed while another sequence is being run, making
the instrument and process much more productive.
This should be a mandatory requirement for regulated laboratories, and suppliers should respond by
providing this feature.
No USB devices
Although section 15 of draft Annex 1110 and PIC/S 041 9.5.5 2 appear to allow the use of USB devices, the
advice is simple: Don’t use them.
In fact, many IT departments disable unused USB ports. Suppliers offering USBs for data transfer or
backup in regulated environments should not. Especially if the means of transferring or backing up data
are manual, by drag and drop, or copy and paste. This specific practice resulted in a US Food and Drug
Administration (FDA) warning letter to BBT Biotech for copying and pasting data onto a CD.11
If you must transfer by USB, it needs an automated and validated process for data backup and transfer.
Suppliers please take note!
External Service Providers
SaaS: The validation treadmill
Using Software as a Service (SaaS) involves inherent DMDI risks. Continuous incremental upgrades,
e.g., every 3–4 months, could introduce risks that might impact archived data if a change in data format
affects data readability. Performing a full backup, including data, metadata, and audit trail, should be performed
before the system upgrade.
However, the problem of these relatively frequent upgrades is the impact on the validation status of
the SaaS application. In our view, it is better if SaaS suppliers bundled all upgrades into a single annual
release, which allows for a better assessment of the changes and a more comprehensive and targeted
revalidation of the system.12
Handling CRO and CDMO suppliers
Contract development and manufacturing organizations (CDMO) and contract research organizations
(CRO) are widely used in the pharmaceutical and biotechnology industries. This allows efficient use of resources,
but the outsourcing company has overall accountability for the work performed on their behalf.
How To Guide
HOW TO ACHIEVE DATA INTEGRITY THROUGH EFFECTIVE DATA MANAGEMENT IN A REGULATED LABORATORY: SYSTEMS AND SUPPLIERS 4
Due diligence for each supplier needs to be performed, especially the assessment of approaches to DMDI.
The quality and/or technical agreement will determine how the two organizations will interact, especially
in the case of deviations and laboratory investigations.
In many cases, data will be transferred by CROs/CDMOs to the outsourcing company. Converting electronic
data into PDF or typing into spreadsheets is unacceptable, as key data and metadata are omitted; for
example, audit trail entries could be overwritten or omitted.
Our suggestion is for the CRO/CDMO to use the same data system as the outsourcing company, so data
can be transferred between the two organizations using a secure file transfer approach. An alternative
is for the contractor to be a separate user group on a network system, e.g., chromatography data system
(CDS). This would allow easier oversight for key analytical systems and ensure DMDI.
The lights are on. Is anyone home?
If a company does not manage its data in both an efficient and compliant way, a regulatory citation from
a health authority may result. Table 1 shows five examples of recent FDA citations dealing with DM.
Although the citations are general and are not as detailed as those for other DI violations, it means that
ignoring effective DM that results in DI violations can result in regulatory non-compliance.
As the saying goes, it is cheaper to be compliant than not.
Table 1: Examples of data management citations from FDA warning letters.
Company Citation
BBC Group13 Provisions for oversight by QA managers, executives, and internal
auditors with appropriate IT expertise (e.g., “to evaluate … data
management practices,…”)
This warning letter also contains multiple DMDI issues, such as loss of
testing data, unrecoverable data, and using static instead of dynamic
data for chromatograms.
Intas
Pharmaceuticals14
“… you acknowledge the discrepancies … and identify the contributing
factors to these deviations as inadequate data management
processes, …”
Amman
Pharmaceutical
Industries15
“Your response plans to perform a holistic quality system review,
including changes to batch record documentation, data management,
and procedures.”
Optikem
International16
“Your response lacked changes to batch record documentation, data
management,…”
Eugia Pharma17 “… data management is critical to CGMP to ensure the completeness,
consistency, and accuracy of data.”
How To Guide
HOW TO ACHIEVE DATA INTEGRITY THROUGH EFFECTIVE DATA MANAGEMENT IN A REGULATED LABORATORY: SYSTEMS AND SUPPLIERS 5
Summary
Section 13 onwards of the FDA Inspection of Pharmaceutical QC Laboratories, published in 1993, focuses
on paper notebooks, worksheets, and logbooks, coupled with the discovery of unofficial testing.18
When compared with the warning letters cited in Table 1, it’s clear that not much has changed in many
regulated laboratories.
Although some guidance documents consider risk-based and practical expectations on DMDI, in many
laboratories, little has changed in over 30 years. Why? The level of senior management's involvement in
allocating enough resources is key to supporting laboratory digitalization and upgrading systems to improve
DMDI. Remember—keeping current is a requirement of both US and EU GMP.19, 20
Acknowledgements
With thanks to Monika Andraos, Chris Burgess, Bob Iser, and Paul Smith for their time and effort in
reviewing this article. With thanks also to Paul Smith for identifying FDA warning letter citations for
this article.
Sponsored by
References
1. Data Management and Data Integrity (DMDI). Therapeutic Goods Administration. https://www.tga.gov.au/products/regulations-
all-products/manufacturing/data-management-and-data-integrity-dmdi. Last Updated April 6, 2017. Accessed
November 12, 2025.
2. Good Practices for Data Management and Integrity in Regulated GMP / GDP Environments. https://www.gmp-compliance.
org/files/guidemgr/PI%20041-1.pdf. Published July 1, 2021. Accessed February 4, 2026.
3. WHO Technical Report Series No.996 Annex 5 Guidance on Good Data and Records Management Practices. World Health
Organisation: Geneva, 2016.
4. WHO Technical Report Series No.1019 Annex 3, Appendix 5 Validation of Computerised Systems. World Health Organisation:
Geneva, 2019.
5. WHO Technical Report Series 1033, Annex 4 Guideline on Data integrity. World Health Organisation: Geneva, 2021.
6. 21 CFR Part 11; Electronic Records; Electronic Signatures Final Rule. Federal Register 1997, 62 (54), 13430 - 13466.
7. McDowall RD. Validation of Chromatography Data Systems: Ensuring Data Integrity, Meeting Business and Regulatory Requirements.
Royal Society of Chemistry; 2017.
8. FDA Warning Letter Ohm Laboratories Food and Drug Administration: Rockville, MD, 2009.
9. McDowall RD. What Exactly Are Orphan Data? LCGC Europe. 2022;35(9): 381-387.
10. Stakeholders’ Consultation on EudraLex Volume 4 - Good Manufacturing Practice Guidelines: Chapter 4, Annex 11 and
New Annex 22. European Medicines Agency, 2025. https://health.ec.europa.eu/consultations/stakeholders-consultationeudralex-
volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en Accessed September 20, 2025.
11. FDA Warning Letter BBT Biotech Gmbh (Warning Letter 320-16-12). Food and Drug Administration: Sliver
Spring, MD, 2016.
12. Lotfinia M, McDowall RD. What Goes in a CDS IT Service Level Agreement? LCGC International. 2025;2(3): 18-27.
13. FDA Warning Letter BBC Group Limited. Food and Drug Administration, 2021. https://www.fda.gov/inspections-compliance-
enforcement-and-criminal-investigations/warning-letters/bbc-group-limited-614659-08042021 Accessed November
13, 2025.
How To Guide
HOW TO ACHIEVE DATA INTEGRITY THROUGH EFFECTIVE DATA MANAGEMENT IN A REGULATED LABORATORY: SYSTEMS AND SUPPLIERS 6
14. FDA Warning Letter Intas Pharmaceuticals. Food and Drug Administration, 2023. https://www.fda.gov/inspections-compliance-
enforcement-and-criminal-investigations/warning-letters/intas-pharmaceuticals-limited-662868-11212023
Accessed November 13, 2025.
15. FDA Warning Letter Amman Pharmaceutical Industries Food and Drug Administration, 2024. https://www.fda.gov/
inspections-compliance-enforcement-and-criminal-investigations/warning-letters/amman-pharmaceutical-industries-
668867-02142024 Accessed November 13, 2025.
16. FDA Warning Letter Optikem International Inc. Food and Drug Administration, 2024. https://www.fda.gov/inspections-
compliance-enforcement-and-criminal-investigations/warning-letters/optikem-international-inc-680264-06202024
Accessed November 13, 2025.
17. FDA Warning Letter Eugia Pharma Specialities Limited. Food and Drug Administration, 2024. https://www.fda.gov/
inspections-compliance-enforcement-and-criminal-investigations/warning-letters/eugia-pharma-specialities-limited-
681905-08152024 Accessed November 10, 2025.
18. Inspection of Pharmaceutical Qualiy Control Laboratories. Food and Drug Administration, 1993. https://www.fda.gov/
inspections-compliance-enforcement-and-criminal-investigations/inspection-guides/pharmaceutical-quality-control-
labs-793 Accessed November 13, 2025.
19. Facts About the Current Good Manufacturing Practices (CGMPs). Food and Drug Administration, 2021. https://www.fda.
gov/drugs/pharmaceutical-quality-resources/facts-about-current-good-manufacturing-practices-cgmp Accessed January
3, 2026.
20. Commission Directive 2003/94/EC laying down the principles and guidelines of good manufacturing practice in respect
of medicinal products for human use and investigational medicinal products for human use. European Commission:
Brussels, 2003.
How To Guide
