Data Integrity & ALCOA+ in Pharma -Practical Approach

Let’s start from the very beginning.
When we talk about data generation, we’re talking about the exact moment when data is born.

Not when it’s reviewed.
Not when it’s approved.
Not when QA looks at it.

Today we are going to talk about data processing.

When we say data processing, we mean all the actions we perform on data after it has already been generated.

Hey, welcome. Today we’re talking about Data Review—not the buzzword version, the real-life version.
Data Review is the moment where data stops being “numbers on a screen” and becomes a decision.
And in GxP, decisions are serious: release a batch, reject a batch, approve a result, close a deviation, trend a process, or prove to an inspector that everything is under control.

So if you remember one thing from this presentation, let it be this:
Data review is not paperwork. It’s decision protection.

Let’s start from something very simple.
Reporting is the moment where data stops being “numbers on a screen” and becomes a decision tool.

Imagine you did a test in the lab. You measured something, you got a result.
That result alone is not enough.
Reporting is the process of explaining what happened, how the result was generated, and why it can be trusted.

From a regulatory perspective, archiving is not historical storage - it is active regulatory exposure.

FDA and EMA assess archived data to confirm long-term control over product quality.

If archived data cannot be retrieved, read, or reconstructed, it is treated as a current compliance failure, not a legacy issue.

Let’s start with the big picture.

When we say Data Governance, we’re not talking about another QA buzzword or an IT-only topic. Data governance is basically the operating system behind trust in data.

Today I want to talk about something that sounds very basic, almost obvious  attribution.

But in reality, this is one of the most common reasons documents fail QA review or turn into deviations.

When we talk about data integrity, people often think about fraud or intentional manipulation.

But in reality, most issues I’ve seen didn’t come from bad intentions at all. They came from pressure, speed, workload - and handwriting.

When we talk about contemporaneous, a lot of people instinctively think:

“same day”, “before the end of the shift”, or “as soon as I had time”.

When we talk about Original data, people often think it just means “the first file” or “the first paper”.

But in reality, Original is about how and where the data was born.

When we talk about data integrity, people often think about systems, audit trails, or regulations.

But in reality, accurate and complete data is about trust.

When inspectors talk about trust in data, they’re not asking whether a single value is correct.

They’re asking something much deeper: does the data tell a reliable story from start to finish?

When we talk about audit trails, I want to be very clear about one thing from the start:
this is not an IT feature, and it’s not just a technical log running quietly in the background.

In real life, audit trails are what regulators use to reconstruct your quality decisions.
They are the story of what actually happened to the data — not what we say happened.

Access control is not an IT preference — it’s a data integrity control.

If anyone can access, change, delete, or approve data, then the question is simple:

Can we trust the data?

Regulators look at access control as direct evidence of whether ALCOA+ principles are truly implemented.

Strong access control protects data, decisions, product quality, and ultimately patient safety.

From a regulator’s point of view, that’s not an IT problem. That’s a quality problem.

If data cannot be recovered, it cannot support product quality decisions. And if decisions are based on missing data, patient safety is immediately at risk.

Let’s slow down for a second, because this is where a lot of teams already make their first mistake.

When we talk about data transfer, we’re talking about moving data without changing its nature.
Same structure, same logic, same meaning — just moving it from one location or system to another.

When we talk about data integrity in a QC laboratory, it’s important to stop thinking in terms of single records and start thinking in terms of flow.
Data integrity is not created at the review stage – it starts much earlier, the moment a sample is received in the lab.

In real life, a QC workflow includes sample receipt, identification, testing, raw data generation, calculations, review, approval, reporting, and finally archiving.
Each step creates data, and each step depends on the integrity of the previous one.