Is Your Validation Team Ready For GDPR?

GDPR stands for the General Data Protection Regulation.  It governs all personal data collected by companies for customers, potential customers, employees, and others.  Regulators are keen to understand how this information is managed and maintained over time.

In April 2016 the FDA issued new draft guidance for data integrity and compliance with cGMP. The guidance was issued in a question and answer style format and focused on frequently occurring data integrity lapses. When the FDA finalizes the guidance, it will represent their current thinking on data integrity and cGMP compliance for the industry.

Why did the FDA draft such guidance? It should be noted that the FDA has increasingly observed cGMP violations involving data integrity during the inspection process. Over 21 warning letters have involved data integrity lapses in drug manufacturing since January 2015. The FDA strongly believes that ensuring data integrity is an important component of the industry’s responsibility to ensure the safety, efficacy, and quality of drugs to protect public health and safety overall.

In recent years, many articles have been written that referred to data integrity using the ALCOA which means that data has to be attributable, legible, contemporaneous, original or true copy, and accurate. It should be noted that the requirements for record retention and review do not differ depending on the data format. Paper-based and electronic record-keeping systems are subject to the very same requirements.  For example section 211.68 requires that backup data be exact and complete and secure from alteration, inadvertent erasures, or loss. Section 211.180 requires true copies or other accurate reproductions of the original records.

Most life sciences companies validate business systems that have GMP impact. It is best practice to conduct installation, operational, and performance qualification testing to demonstrate that a computer system is fit for its intended use and document any incidents that may affect software quality or the reliability of the records. Data integrity and validation go hand in hand but with the latest guidance there’s really nothing new under the sun from a validation perspective. The same level of due diligence and rigor must be applied to confirm that systems are suitable for their intended use and that the data integrity within these systems is sound.

When you are examining data integrity issues it is critically important to look at all aspects of the system including system security and how it is established to ensure that records entered into the system have the highest level of integrity. The FDA recommends that you restrict the ability to alter files and settings within the system to those administrator users that require such access. A recent warning letter cited the failure to prevent unauthorized access or changes to data.

For systems design in accordance with 21 CFR part 11 it is critical to understand that audit trails should be independent. I know this doesn’t come as a surprise for many but I have seen systems where the audit trail could be turned on or off. Let me be clear. All systems designed in accordance with 21 CFR part 11 must have an independent audit trail generated by the computer such that the audit trail cannot be turned off by ordinary means. This means that someone cannot go to a common function within the system and turn off the audit trail. The FDA recommends that audit trails that capture changes to critical data be reviewed with each record and before the final approval of the record. They recommend that audit trails be subject to regular review. Recent warning letters have cited a lack of audit trail for lab instruments for example and the fact that audit trails can be turned off. If an audit trail can be turned off, fraudulent activity may occur. It is important for you to confirm within your systems that the audit trails are capturing information regarding the each record and that these audit trails are independent to ensure data integrity.

Data integrity is not a new concept but it is one that is receiving a lot of attention. Compliance with data integrity guidelines represents more of common sense for those in the compliance business. Look at data integrity not as the latest buzzword but as a reminder of how important it is to ensure the integrity and authenticity of data established and maintained within validated systems environment. This will go a long way to ensuring sustained compliance.

What Data Integrity Means For Validation

After much fanfare, the general data protection regulations (GDPR) was approved by the EU parliament on April 14, 2016. The enforcement date for this regulation is May 25, 2018. If companies are not in compliance at that time the potential for heavy fines is inevitable. The EU general data protection regulation replaces the data protection directive 95 /46/EC and was designed primarily to harmonize data privacy laws across Europe and to protect and empower all Eve’s citizens data privacy and reshape the way organizations across the region approach data privacy. The regulation has a profound impact on businesses that operate in the EU. Maximum penalties may be as high as 4% of annual global turnover or €20 million (whichever is higher).

In recent years, we have seen massive data breaches at companies which has exposed private information and other sensitive information without consent. Many of these breaches have been due to cyber-attacks against companies of different sizes. The newspapers are full of such data breaches. The new GDPR regulation requires that breaches be reported to the relevant regulator without undue delay and where feasible, within 72 hours of becoming aware of it unless the breach is unlikely to result in a risk to the right and freedom of individuals. Data subjects must be informed without undue delay with the breaches likely to result in a high risk to the data subjects’ rights and freedoms unless the data has been rendered unintelligible to any third party (for example by encryption). Data processors are required to inform data controllers of any breach without undue delay.

What does all this mean for validated systems?

If you operate in the EU and your validated systems include sensitive data or data which may be of a personal nature, such as patient information, you are subject to the guidelines included within the GDPR regulation. You also need to look at data integrity and security practices around the validated system. We recommend strongly the Cybersecurity Qualification (CyQ ) discussed in a previous post. The CyQ assesses a firm’s readiness to protect itself against the cyber-attack. This could go a long way to meeting the requirements of GDPR since the cyber security qualification requires documentation of your security controls.

I recommend reading GDPR and getting used to it before May 2018. Assess your controls within your validated systems environment to determine how vulnerable your systems really are and your readiness to comply with this regulation. I assure you more will be forthcoming about this topic in the months to come.  WATCH THIS SPACE.