GxP data integrity across legacy LIMS, EDC, CRO-held and vendor-hosted systems does not have to start with replacing platforms. You first decide which electronic artefacts make up the record. Then you map where every copy lives and who controls it, and retrofit the audit-trail, ownership and retention controls that the gaps call for, so each record stays retrievable and attributable for as long as the law requires. For EU clinical trials that is a long time: Regulation (EU) No 536/2014, Article 58, requires the sponsor and the investigator to archive the trial master file for at least 25 years after the trial ends. It also says that any alteration to that content must be traceable.
The retention clocks behind GxP data integrity for trial records
The bar the regulators set is ALCOA+: data must be attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available, according to the MHRA’s 2018 GxP data integrity guidance. The last two, enduring and available, must hold for the whole retention period, and that period depends on the regime and the type of record.
| Regime | What it covers | Minimum retention |
|---|---|---|
| EU CTR (536/2014), Article 58 | Content of the clinical trial master file | At least 25 years after the end of the trial |
| UK amended Clinical Trials Regulations, Regulation 31A | Essential documents and participant medical files | At least 25 years from the conclusion of the trial, longer if needed for marketing authorisation |
| ATIMP traceability (EMA TMF guideline) | Documents giving full traceability of an advanced therapy product | 30 years after product expiry, or longer if the authorisation requires it |
| FDA 21 CFR 312 (investigator records, human drugs) | Records of the clinical investigation | 2 years after marketing approval for the indication, or 2 years after the investigation is discontinued and FDA notified |
The EMA’s TMF guideline applies these retention times to documents held by CROs and other agents of the sponsor as well. FDA guidance on computerised systems in clinical trials requires audit trails to be kept at least as long as the records they relate to. The EMA’s 2023 guideline on computerised systems puts the stakes plainly: a lack of integrity before the mandated retention period ends may render the data unusable and is equivalent to data loss or destruction.
Which electronic artefacts count as the official GxP record, and which are only working copies?
The official GxP record is everything needed to reconstruct and evaluate what happened to a data point: what was captured, what changed, who did it, when and why. WHO’s 2021 data integrity guideline defines data as all original records and true copies, including source data and metadata, together with every later transformation and report that allows the activity to be fully reconstructed and evaluated. The MHRA expects the retention process to keep verified copies of raw data, metadata, the relevant audit trail and result files, record-specific configuration settings, and all data processing runs needed to reconstruct a raw data set. For clinical trials the MHRA recognises the ICH E6(R3) definition of essential records: documents and data, with their relevant metadata, in any format.
Inventories commonly miss the context. Teams list the tables and document files, but a complete record may also need its version, user attribution, timestamps, audit trail, electronic signature, status, master-data relationships, or the calculation logic in use at the time. The system of record is where the original sits with its full metadata and audit trail, and a PDF or export does not replace it unless a validated migration has kept every required element. PIC/S PI 041-1 goes further: it prohibits creating PDF versions of electronic data wherever metadata could be lost.
The classification has to be written down. The MHRA expects hybrid systems to have a documented definition of the whole data set. ICH E6(R3) asks the investigator to define what counts as a source record, and where it is captured, before the trial starts. Jurisdiction also matters. The EMA expects archiving to meet the requirements of every region where the data may support a submission, not only the country where it was generated.
If a value is corrected or overridden, do you keep the original, the correction, or both?
Keep both, linked through the audit trail. The MHRA expects audit trails to show every change while keeping the previous and original data, with the person, the date and time stamp, and the reason. The EMA’s 2023 guideline says the audit trail should show the initial entry and each change, with the previous and current value, the field, the user and role, the timestamp and, where applicable, the reason. An override is treated as a change too, with a recorded reason. Keeping only the final value removes the lineage an inspector will ask to follow.
Does ePRO raw data need separate retention from the EDC-ingested version?
The answer depends on whether the EDC receives the data with all its metadata. The EMA treats the first permanent data obtainable from electronic capture as the electronic source, and the place where it was first obtained should form part of its metadata. The same guideline calls transfer of source data without keeping the original “a critical process” that needs safeguards against losing data and metadata. FDA’s 2024 guidance on electronic systems in clinical investigations locates the source data for digital health technologies in the durable repository that receives the data and all its metadata over a direct, uninterruptable and secure connection. If your EDC copy meets that bar, it can serve as the source record. If the transform drops fields, timestamps or other metadata, the EDC copy does not meet that bar. A vendor-side API version change counts as a change that triggers revalidation of the field mapping.
Derived values need their processing kept as well. The MHRA expects user-defined processing parameters to be traceable to the raw data, and audit trails to allow reconstruction of all processing, whether or not the output was ever reported. FDA guidance lists the computational methods used to derive data among the information to preserve during migration. For a model output, that means retaining the inputs, the configuration settings and the processing method alongside the value.
| Artefact | Classify as | Basis |
|---|---|---|
| Raw source capture (instrument file, ePRO entry, sensor stream) | Part of the record | The first permanent electronic capture is the source |
| Audit trail | Part of the record, kept as long as the data | Retention at least as long as the subject records |
| Original value plus its correction or override | Both part of the record | Changes must retain previous and original data |
| AI- or algorithm-derived value | Part of the record, with its processing parameters and derivation method | Processing must be reconstructable |
| PDF or CSV export of system data | Working copy, unless a validated true copy with metadata | Exports do not replace the system of record |
| Transient screen render or cache holding nothing unique | Working copy | Nothing it holds is missing from the record and audit trail |
Mapping lineage across legacy LIMS, EDC and acquired systems without migrating them first
The starting artefact is an inventory. PIC/S expects one listing each computerised system’s name, location and primary function, an assessment of the criticality of the system and its data, and its current validation status. The EMA asks for the physical and logical locations of data, the system interfaces, and how those interfaces are validated and secured. FDA’s 2024 guidance asks the sponsor to document the electronic systems used in each investigation, including a diagram of data flow from creation to final storage. PIC/S notes that a data flow map is particularly useful for understanding risk in interfaced systems.
For legacy lineage, the guidance points to three pieces of documentation: the inventory, the data-flow diagram, and evidence that each system’s audit trail is complete, enabled and reviewed. WHO expects periodic verification that audit trails remain enabled throughout the data lifecycle. PIC/S expects legacy systems to be evaluated, with additional controls added where their design does not give adequate control. Building the full stage-by-stage lifecycle map, with a named owner for every intermediate export, is a separate piece of work. The inventory and diagram are its foundation.
You can gain visibility into inherited legacy systems without overhauling them. Migrate or remediate only the systems whose audit trail is missing or incomplete, because no mapping can recover events the source never recorded.
Who is responsible for GxP records if a CRO decommissions its system before the retention period ends?
The sponsor stays responsible unless ownership has been formally transferred. ICH E6(R3) lets a sponsor transfer trial activities to a service provider, but ultimate responsibility for the reliability of the trial data stays with the sponsor. The EMA’s 2023 guideline says the same of data integrity, security and confidentiality when tasks are delegated. Article 58 of the CTR requires any transfer of ownership of the TMF content to be documented, and the new owner assumes the responsibilities set out in that Article. A CRO shutting down its platform does not move the sponsor’s responsibility. It only removes the place where the obligation was being met.
The contract is where continued access for the retention period gets secured. These are the terms that do the work:
- Data ownership, export formats, notice before service changes, backup and retention responsibilities, and assistance at termination.
- Reliable, continued and timely access to the data if the vendor goes bankrupt, shuts down, suffers a disaster or discontinues the service, or if the sponsor changes vendor.
- On decommissioning, archived formats that let the database be restored, including its dynamic functionality and all relevant metadata such as audit trails and event logs.
- Notification if an external archive changes the storage location of the TMF, plus provisions for either party going out of business.
- The timing, process and format for transferring materials from the CRO back to the sponsor.
- Continued access to validation documentation for the full retention period, even after the vendor stops supporting the system.
FDA’s 2024 guidance adds that when a hosted-system contract ends, the sponsor should obtain and keep the metadata in a form that links to each corresponding data element. A contract clause alone is not enough: the exit and archival plan has to be validated and tested as well. A CRO can honour every clause and still hand back data that no available software can open.
How do you test that an archived GxP record is still readable and attributable a decade later?
You retrieve it on a schedule and check it. Assuming it is fine does not count. The EMA’s TMF guideline lists periodic test retrievals or restores among the controls an eTMF should have. A guide to GxP data archiving during decommissioning explains why the test must go beyond opening a file: a future user has to be able to find the correct record in a reasonable time, display it completely and use it for its intended purpose. A workable procedure runs in this order:
- Select a risk-based sample, weighted by data criticality, remaining retention period and where the data is held.
- Recompute checksums for each sampled object and compare them with the stored values, which the digital preservation community calls fixity checking.
- Have someone who did not archive the record locate it, then check that it displays completely in a supported viewer.
- Confirm that the metadata, including user identity, timestamps and audit-trail entries, still links to each data element.
- Confirm that the record can be searched and sorted, or exported to a tool that can do so, as the 2025 Annex 11 consultation draft expects.
- Log the results, and handle any failure as a deviation with root cause analysis and preventive action.
- Repeat periodically and after any relevant change to the system.
The GCP archiving guide from the HSRAA recommends a risk-based schedule for reading and testing records held on storage media. PIC/S expects data integrity controls to be assessed periodically through self-inspection, and that is the natural home for this test. A passing sample does not prove every record is retrievable, so the sampling has to rest on a documented risk assessment. A record can also stay perfectly readable while losing its attribution, if its metadata was not preserved with it.
What evidence should you ask cloud, SaaS and CRO vendors for to show their data handling meets ALCOA+?
Ask for evidence specific to the vendor’s system and to your configured use of it. Vendor documentation counts only once you have checked that it covers the version you actually run. One validation practitioner puts it bluntly: there is no inherently compliant product, and the sponsor stays accountable for assessing the vendor and validating the configured system. The 2025 Annex 11 consultation draft says the regulated user remains fully responsible for outsourced activities and for keeping the evidence.
TechnoLynx’s part in that dossier is narrow. Where an AI model’s verification and validation package is part of the evidence trail, TechnoLynx packages its independent-auditor replay capability and traceability artefacts so they can be referenced alongside the vendor’s separately obtained data-handling audit evidence. TechnoLynx builds evidence of this kind as an engineering output that a reviewer can read and defend. It is not legal advice or regulatory sign-off. Our AI engineering for life sciences and healthcare covers that work, and a worked example shows what a HIPAA/GxP workflow audit-evidence pack contains. A model package documents the model. It does not show that the vendor handled the upstream raw data correctly, so it supplements the vendor audit and never replaces it.
| Evidence to request | Why it matters | Regulatory anchor |
|---|---|---|
| Validation and qualification documentation, checked against the version you actually run | The regulated user must review it and decide whether it covers the implemented version | Part 11 §11.10(a) validation; Annex 11 clause 3 supplier qualification |
| Audit-trail exports in a searchable, sortable form | EMA inspectors have received audit trails as PDF flat files, which made it hard to produce the datasets an inspection needs | Part 11 §11.10(e) audit trails |
| Accurate, complete copies in human-readable and electronic form | Part 11 requires systems to produce such copies for inspection | Part 11 §11.10(b) |
| A defined exit plan and retrieval through the full retention period | Records must stay retrievable after vendor exit | Part 11 §11.10(c) |
| User access records with dates, rights and changes | Inspectors may review who was authorised and when | Annex 11 user management and documented access reviews |
| Wearable data provenance from sensor to gateway to cloud to sponsor | Gaps must be detectable, attributed and quantified | FDA expects the transfer date and time from the device to the repository in the audit trail |
| A current audit report, on-site where risk warrants it | PIC/S says a desktop assessment does not normally establish data integrity compliance | MHRA expects oversight throughout the trial, not only at selection |
For cross-referencing, Part 11 places data integrity requirements in clauses 11.10, 11.30 and 11.300, and Annex 11 addresses data management across its lifecycle in clauses 5, 6, 7, 8 and 17. If the vendor’s last audit predates major platform changes, request an updated audit, since oversight must continue throughout the trial. The Annex 11 draft also expects contracts to define an exit strategy that lets the regulated user keep control of system data.
Can ownership and audit-trail controls be added to existing CSV exports instead of replacing the LIMS?
Yes, provided the added controls are proven effective. The MHRA accepts alternative controls where legacy systems lack audit-trail functionality, such as SOP-defined processes and log books, as long as they are proven effective. PIC/S expects legacy systems to meet the same basic requirements, possibly through supporting administrative procedures or supplementary security software. The weak point is the handoff between systems. Data leaves a validated instrument as a CSV, sits in a network folder for review, and is imported into the LIMS, and at each step the chain of custody becomes unprovable.
Life-science software vendor Instem describes a wrapper that sits around existing systems rather than inside them. It records file and folder events, named users and timestamps, and changes made outside the validated application, without modifying the LIMS. The same source is candid about the limits. A wrapper can tell you that a spreadsheet changed but not which cell, it does not make the LIMS itself Part 11 compliant, and its approach is limited outside Windows environments. Other controls that fit around exports include checksums and secure transfer at interfaces, access records kept outside a system that does not capture them, and a read-only status or a validated move to an archive once a process is complete, with integrity verified by checksum before anything is deleted.
Retrofits come with a time limit. WHO treats mitigation for legacy systems without ALCOA+ support as a measure for defined temporary periods, to be addressed within defined timelines. The MHRA justifies continued use by documented evidence that a compliant solution is being sought. PIC/S expects interim measures to be monitored and residual risk to be communicated to senior management. Confirm with QA that the compensating controls and their plan will be accepted, before treating the retrofit as the end state.
| What the gap mapping finds | Route |
|---|---|
| Missing ownership metadata, audit trail at handoffs, or retention duration | Retrofit the export pipeline: ownership tags, wrapper or log-based audit trail, checksummed archive |
| Mutable records, no chain of custody, unvalidated transfers | Deeper remediation touching the export logic or the LIMS configuration |
| Retrofit cannot meet requirements at reasonable cost | Plan the LIMS change, with interim controls documented in the meantime |
Cost and timeline cannot be stated honestly until the gaps are listed. What drives the estimate is how many handoffs lack custody evidence and whether any record can be altered in place. The size of the LIMS matters much less. Storage media, file formats and software all become obsolete over that period. The Arkivum and HSRAA whitepaper recommends migrating into open, long-lived formats at or before archiving, while staff who understand the content are still available. When legacy software can no longer be supported, the MHRA suggests maintaining it in a virtual environment, with migration to another format as the data ages. The GCP archiving guide considers CDs, DVDs and flash drives unsuitable for long-term storage.
How do you square 25-year GxP retention with GDPR data minimisation for derived copies of trial data?
The TMF copy is kept to meet a legal obligation, so the 25-year clock applies to it. Derived copies outside the TMF need their own justified retention period. The European Commission’s Q&A on clinical trials and the GDPR treats all processing under a protocol, from the start of the trial to deletion at the end of the archiving period, as primary use. It names TMF archiving for 25 years under Article 58 as one of those obligations. The Q&A adds that withdrawal of consent does not affect processing based on other lawful grounds, in particular legal obligations. The EMA’s 2023 guideline says retention periods should still respect the data protection principle of storage limitation.
The pressure point is the analysis extract, the warehouse copy or the model-training split that nobody filed in the TMF. The ICO’s position is that you must justify how long you keep personal data, and you should not keep it indefinitely “just in case”. It expects a retention policy with standard periods and periodic review, followed by erasure or anonymisation. A retention schedule lists record types, what each is used for and how long it is kept. Data protection consultancy TechGDPR, writing about the EU AI Act’s ten-year documentation rule, argues for architectural separation: raw personal data is deleted automatically, and the long-lived audit trail is built exclusively from non-personal, irreversibly anonymised assets. The clinical case is different, because the TMF itself must stay for 25 years, but the separation pattern carries over to derived analytics and training copies.
An auditor who wants to see that you know where the data lives and who deletes it will look for an asset register of records, their content, format and value, and a record of processing activities informed by data flow mapping. For each processing activity, the ICO expects that record to show the data’s source, where and how it is stored, and its retention period. The record should be granular enough to show different retention periods for different categories, and kept as a living document. Accountability needs names. The CTR requires the sponsor to appoint individuals responsible for archives, and ICH E6(R3) asks for a record of the important computerised systems that describes who is responsible for managing each one. The lineage map built for GxP purposes is the natural source for finding derived copies, which is one more reason to build it once and well. Whether a given schedule is defensible under minimisation is a legal judgement for your DPO and counsel. Tooling and maps only supply the evidence trail.
Can every vendor deliver its part of the data-flow evidence in time for the inspection?
Confirm it vendor by vendor now. Check each contract for an evidence-on-request clause, and escalate immediately for any vendor that lacks one or has a weak compliance history. The MHRA inspectorate describes missing information in vendor contracts and agreements as one of the main issues it sees on inspection in this area. Its case studies include contracts that were missing or lacked detail, and delegation of duties that was not completed until just before the inspection. The EMA’s GCP Q&A warns that failure to provide access to vendor qualification documentation is likely to result in critical findings. Its remedy is to amend the contract, and where a vendor refuses, the sponsor has to show the system’s validated state itself or requalify it. Inspectors have found agreed outputs missing, among them metadata, audit trails and the delivery format of the complete database.
Escalate first for any vendor that has no clear clause, has outdated questionnaire answers, or needs internal legal or QA sign-off before releasing anything, since a two-week window can be too short for such a vendor even when it is willing. This is QA and vendor-management work. The engineering contribution is the data-flow map, which shows which vendor owns which segment and what evidence each segment needs.
Classification is the decision everything else inherits
The custody map, the contract clauses, the retrievability test and the deletion schedule all start from the same list of what counts as the record. An ePRO stream classified as a working copy can be left out of the CRO’s exit plan, the fixity checks and the ROPA. Regulators accept documented compensating controls on legacy systems, but they frame them as interim measures with a plan behind them, so the justification and the timeline are as much part of the evidence as the controls themselves.
FAQ
What is the difference between 21 CFR Part 11 and Annex 11?
Part 11 is the FDA’s set of requirements for electronic records and signatures used in place of paper and handwritten signatures. Annex 11 is part of EudraLex Volume 4 and gives guidance on GMP for computerised systems used for medicinal products. It requires a lifecycle approach to validation that runs through to system retirement.
