Skip to main content

Pharmakon Life Science

What is data integrity in IT systems?

Understand ALCOA+, data integrity, and the requirements for traceable and reliable data.

What is data integrity in IT systems?

Data integrity is one of the GMP areas on which regulatory authorities place a strong emphasis during inspections. 

Requirements are set forth regarding, among other things, validation, access control, audit trails, data security, and supplier control. 

IT systems are therefore an integral part of the quality management system.

On this page, you'll find answers to:

  • What is data integrity?
  • Which IT systems are subject to GMP requirements?
  • What is ALCOA++, and why is it important?
  • What are some common data integrity issues?
  • What does data integrity mean for your day-to-day work?
  • How do you assess whether data integrity is in place?

What is data integrity?

Data integrity is all about making sure that data is accurate, reliable, and trustworthy
– throughout its entire lifecycle.

Here's what applies to data:

  • they are recorded correctly and in a timely manner.
  • They are not changed without traceability.
  • They cannot be deleted, made to disappear, or tampered with without being detected.


In practice, data integrity is about:

  • Audit trail (change log) for critical data, so that all changes are visible and automatically logged.
  • Data is locked after approval to ensure that the final version is preserved.
  • Access and changes can only be made with the appropriate access rights and role.

Data integrity isn't about data never changing – it's about making sure all changes are documented, justified, and traceable.

Which IT systems are subject to GMP requirements?

All IT systems used to create, modify, store, or transmit GxP data are subject to data integrity requirements. This includes, among others, LIMS, MES, ERP, temperature loggers, and SCADA systems.

Data integrity covers all data that affects product quality or patient safety – things like batch records, temperature data, inspection reports, login logs, and much more. 

IT systems are an integral part of the quality management system. Requirements are set for:

  • • Validation of the system (to ensure it functions as intended)
  • • Access control (who can view and edit what)
  • • Audit trail (automatic log of all changes)
  • • Data Security and Backup
  • • Supplier audits of software and IT systems

In the EU, the requirements for computerized systems are described in Annex 11, while the FDA sets forth similar requirements in 21 CFR Part 11.

What is ALCOA++, and why is it important?

ALCOA++ represents the cornerstones of data integrity and describes the requirements that all GxP data must meet. The letters stand for Attributable, Legible, Contemporaneous, Original, and Accurate—with the + standing for Complete, Consistent, Enduring, and Available.

A Attributable Who did what, when?
L Legible Readable and understandable
C Contemporaneous Recorded as it happened
O Original Not overwritten, deleted, or tampered with
A Accurate Precise and correct
++ Complete, consistent, enduring, available, traceable Data shouldn't be able to get lost, disappear, or be forgotten.

What are the typical data integrity errors?

  • Using Excel files without version control, access control, or an audit trail.
  • Deleting and re-entering data without a good reason.
  • “Post-it documentation” – where data is written on paper and then transferred later.
  • Shared user accounts – so you can't tell who did what.
  • No backup or recovery plan for critical data.

 

Example:

An employee writes down production data on a piece of paper and enters it into a system in the afternoon. It seems harmless—but it violates ALCOA++. The data is not “contemporaneous” (recorded in real time) and cannot be verified as “original.”

What does this mean for you in practice?

In everyday life, data integrity comes down to three simple rules of conduct: always use your own login, document things immediately—not afterward—and report system errors and security concerns, even if everything seems to be working fine.

  • Use a unique login – no one is allowed to use another person's username.
  • Document right away, not later.
  • Write legibly and correctly – and never change documentation without traceability.
  • Report system errors and uncertainties – even if it seems to be working.
  • Set requirements for IT vendors and software if the system is used for GxP.

Is data integrity ensured?

Questions Yes No
Does the system have an audit trail so changes are logged automatically? ⬜ ⬜
Can access be restricted so only the right users can change data? ⬜ ⬜
Are backup and recovery in place? ⬜ ⬜
Has it been validated that the system works as intended? ⬜ ⬜
Do you document your usage – including exceptions? ⬜ ⬜

Read more

Download the GMP Dictionary (search for Pharmakon): App Store (iOS) or Google Play (Android)

Want to make sure your systems and data meet the requirements?

Use it in practice

  • Reflection Exercise: Review a typical system in your daily work. Is it ALCOA++ compliant? What could be a risk?
  • Dictionary: Use the dictionary to look up terms like "audit trail", "data migration", and "electronic signatures".