2024-01-23 13
This guidance represents the current thinking of the Food and Drug Administration (FDA or Agency) on this topic. It does not establish any rights for any person and is not binding on FDA or the public. You can use an alternative approach if it satisfies the requirements of the applicable statutes and regulations. To discuss an alternative approach, contact the FDA office responsible for this guidance as listed on the title page.
The purpose of this guidance is to clarify the role of data integrity in current good manufacturingpractice (CGMP) for drugs, as required in 21 CFR parts 210, 211, and 212. Unless otherwise noted, the term CGMP in this guidance refers to CGMPs for drugs (including biologics). FDA’s authority for CGMP comes from section 501(a)(2)(B) of the Federal Food, Drug, and Cosmetic Act (FD&C Act). Part 210 covers Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General; part 211 covers Current Good Manufacturing Practice for Finished Pharmaceuticals; and part 212 covers Current Good Manufacturing Practice for Positron Emission Tomography (PET) Drugs. All citations to parts 211 and 212 in this document pertain to finished pharmaceuticals and PET drugs, but these requirements are also consistent with Agency guidance on CGMP for active pharmaceutical ingredients with respect to data integrity2. This guidance provides the Agency’s current thinking on the creation and handling of data in accordance with CGMP requirements.
FDA expects that all data be reliable and accurate (see the “Background” section). CGMP regulations and guidance allow for flexible and risk-based strategies to prevent and detect data integrity issues. Firms should implement meaningful and effective strategies to manage their data integrity risks based on their process understanding and knowledge management of technologies and business models3
Meaningful and effective strategies should consider the design, operation, and monitoring of systems and controls based on risk to patient, process, and product. Management’s involvement in and influence on these strategies is essential in preventing and correcting conditions that can lead to data integrityproblems. It is the role of management with executive responsibility to create a quality culture where employees understand that data integrity is an organizational core value and employees are encouraged to identify and promptly report data integrity issues. In the absence of management support of a qualityculture, quality systems can break down and lead to CGMP noncompliance.
In general, FDA’s guidance documents do not establish legally enforceable responsibilities. Instead,guidances describe the Agency’s current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are cited. The use of the word should in Agency guidances means that something is suggested or recommended, but not required.
inspections. This is troubling because ensuring data integrity is an important component of industry’s responsibility to ensure the safety, efficacy, and quality of drugs, and of FDA’s ability to protect the public health. These data integrity-related CGMP violations have led to numerous regulatory actions, including warning letters, import alerts, and consent decrees. The underlying premise in §§210.1 and 212.2 is that CGMP sets forth minimum requirements to assure that drugs meet the standards of the FD&C Act regarding safety, identity, strength, quality, and purity4. Requirements with respect to data integrity in parts 211 and 212 include, among other things:
- 211.68 (requiring that “backup data are exact and complete” and “secure from alteration, inadvertent erasures, or loss” and that “output from the computer … be checked for accuracy”).
- 212.110(b) (requiring that data be “stored to prevent deterioration or loss”).
- 211.100 and 211.160 (requiring that certain activities be “documented at the time of performance” and that laboratory controls be “scientifically sound”).
- 211.180 (requiring that records be retained as “original records,” or “true copies,” or other “accurate reproductions of the original records”).
- 211.188, 211.194, and 212.60(g) (requiring “complete information,” “complete data derived from all tests,” “complete record of all data,” and “complete records of all tests performed”).
- 211.22, 211.192, and 211.194(a) (requiring that production and control records be “reviewed” and that laboratory records be “reviewed for accuracy, completeness, and compliance with established standards”).
- 211.182, 211.186(a), 211.188(b)(11), and 211.194(a)(8) (requiring that records be “checked,” “verified,” or “reviewed”).
近年,FDA 在 CGMP 现场检查中发现越来越多的 CGMP 违规涉及数据完整性问题。这种现象令人不安,因为数据完整性是药企确保药品安全性、有效性和质量的义务中的重要一环,亦是FDA 保护公众健康的重要内容。这些与数据完整性有关的 CGMP 违规已导致大量强制措施,包括警告信、进口禁令和合意判决。§§210.1 和 212.2 的基本前提是 CGMP 设定了确保药品符合FDCA 关于安全性、鉴别、剂量、质量和纯度方法标准的最低要求。在第 211 和 212 部分中关于数据完整性的要求包括:
When considering how to meet many of these regulatory requirements, it may be useful to ask thefollowing questions:
- Are controls in place to ensure that data is complete?
- Are activities documented at the time of performance?
- Are activities attributable to a specific individual?
- Can only authorized individuals make changes to records?
- Is there a record of changes to data?
- Are records reviewed for accuracy, completeness, and compliance with established standards?
- Are data maintained securely from data creation through disposition after the record’s retention period?
在考虑如何符合这些法规要求时,先提出以下问题可能会有所帮助:
This guidance helps answer these questions and enables an understanding of key concepts behind the regulatory requirements.
While not in the scope of this guidance, data integrity-related CGMP violations can also impact or be directly linked to application filing, review, and regulatory actions.
Electronic signature and record-keeping requirements are laid out in 21 CFR part 11 and apply to certain records subject to records requirements set forth in Agency regulations, including parts 210, 211, and 212. For more information, see guidance for industry Part 11, Electronic Records; Electronic Signatures—Scope and Application, which outlines FDA’s current thinking regarding the scope and application of part 11 pending FDA’s reexamination of part 11 as it applies to all FDA-regulated products.
- This guidance has been prepared by the Office of Pharmaceutical Quality and the Office of Compliance in the Center for Drug Evaluation and Research in cooperation with the Center for Biologics Evaluation and Research, the Center for Veterinary Medicine, and the Office of Regulatory Affairs at the Food and Drug Administration.
- See the International Council for Harmonisation (ICH) guidance for industry Q7 Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients. We update guidances periodically. To make sure you have the most recent version of a guidance, check the FDA Drugs guidance web page at
- See ICH guidance for industry Q9 Quality Risk Management.
- According to section 501(a)(2)(B) of the FD&C Act, a drug shall be deemed adulterated if “the methods used in, or the facilities or controls used for, its manufacture, processing, packing, or holding do not conform to or are not operated or administered in conformity with current good manufacturing practice to assure that such drug meets the requirement of the act as to safety and has the identity and strength, and meets the quality and purity characteristics, which it purports or is represented to possess.”