# Governance, privacy and GxP: why pharma data is different
In 2005, the FDA issued a warning letter to a manufacturer after inspectors found that quality-control data had been overwritten in a shared spreadsheet, with no record of who changed what or when. The product batches tied to that data were quarantined. That single missing audit trail, a record of every change, cost weeks of production and triggered years of regulatory scrutiny.
In most industries, a bad data entry means a cleanup job. In pharma, it can mean a patient gets the wrong dose, or a multi-year drug submission gets rejected. That is why pharma governs data to a standard other sectors rarely encounter.
This lesson explains the three pillars you need to understand: GxP, data integrity (ALCOA), and health-data privacy (HIPAA and GDPR).
GxP is an umbrella term for "Good x Practice" regulations, where the x stands for a specific activity. The common ones:
The shared idea: any activity that can affect patient safety or product quality must be documented, controlled, and reproducible. If a regulator later asks "prove this happened the way you say it did," you must be able to show it.
A retail analytics team can A/B testA/B testA/B testing is a controlled experiment that compares two versions of something (A and B) by splitting traffic randomly to learn which performs better on a chosen metric.View full definition → a new pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → on Monday and change it Tuesday. A GxP team cannot. Every change to a validated system needs a change control: a documented reason, an assessment of impact, testing, and sign-off. This is slower on purpose. The regulator's assumption is that undocumented change is risk.
The core standard for GxP data is data integrity: the assurance that data is complete, consistent, and trustworthy across its entire life, from creation to archiving to deletion.
Regulators summarize this with the acronym ALCOA, later extended to ALCOA+. Data must be:
The "+" adds Complete, Consistent, Enduring, and Available.
Concretely, this is why GxP systems need:
The MHRA's "GXP Data Integrity Guidance and Definitions" (the UK regulator) is a free, readable primer if you want the source material.
Imagine a lab instrument outputs a result to a CSV, and an analyst rounds a value before loading it into the reporting database. In retail, fine. In GxP, that rounded value is a new record with no link to the original. You have broken "Original" and "Accurate." An inspector who finds the raw instrument file and sees a different number will treat the whole dataset as suspect.
A GxP-compliant pipelinepipelineAll active sales opportunities across the stages of the sales process, together with their combined potential value and probability of closing.View full definition → keeps the raw source, records the transformation as a traceable step, and never overwrites the origin:
# Non-compliant: overwrites the source, no trace
df["result"] = df["result"].round(2)
# Compliant intent: preserve raw, log the transformation
df["result_raw"] = df["result_source"] # keep original
df["result_reported"] = df["result_source"].round(2)
# transformation logged with user, timestamp, rule ID in an audit tableThe point is not the code. It is the mindset: the original is sacred, and every change is traceable.
In the US, the rule that ties data integrity to electronic systems is 21 CFR Part 11, a section of FDA regulations. It sets the requirements for electronic records and electronic signatures to be considered as trustworthy as paper and ink.
In plain terms, Part 11 is why your GxP systems need secure logins, audit trails, and controlled access before an electronic signature "counts." The EU has an equivalent concept in Annex 11. If you hear a colleague say "is this system Part 11 compliant," they are asking whether its records would hold up to a regulator.
🎬 [VIDEO: "Data Integrity and 21 CFR Part 11 Explained" — youtube.com/results?search_query=data+integrity+21+cfr+part+11 — a clear walkthrough of ALCOA and electronic records requirements for regulated data]
GxP is about trustworthiness. Privacy law is a separate, overlapping layer about protecting the people in the data. In clinical and real-world data, you are handling some of the most sensitive information that exists.
HIPAA (Health Insurance Portability and Accountability Act) governs how "protected health information" (PHI) is used and disclosed by healthcare providers, insurers, and their partners. PHI is health data tied to an identifiable person: name, medical record number, dates, and more.
For data teams, the practical tool is de-identification. HIPAA defines two accepted methods: Safe Harbor, which requires removing 18 specific identifiers (names, full dates, zip codes below a certain population, etc.), and Expert Determination, where a qualified statistician certifies the re-identification risk is very low. Properly de-identified data falls outside HIPAA's tightest restrictions, which is why so much real-world data analysis depends on getting de-identification right.
The GDPR (General Data Protection Regulation) is the EU's broad privacy law. Health data is a special category with extra protections. Key differences from HIPAA:
The overlap matters. A single global trial can be subject to GCP, HIPAA, GDPR, and other national laws at once. This is why pharma data teams work closely with privacy and legal functions from day one, not as an afterthought.
Knowledge check
1. What is the primary reason pharma governs its data to a higher standard than most other industries?
2. A colleague wants to spin up a brand-new analytics tool and immediately start recording clinical trial results in it. Why is this a problem under GxP?
3. Which underlying principle is shared across all the GxP regulations (GLP, GCP, GMP, GDP)?
4. Select ALL correct answers about the GxP family of regulations and what each covers.
Select all the correct answers.
5. Select ALL correct answers about why an audit trail matters in a GxP environment, based on the lesson.
Select all the correct answers.
Whether you are an analyst, a product manager, or a commercial lead, a few habits separate people who are trusted with pharma data from those who are not.
Assume everything is on the record. In a GxP system, your edits are logged with your name. Work as if an inspector will read the audit trail, because they might.
Never move regulated data into an unvalidated tool. Pulling clinical data into a personal spreadsheet or an unapproved AI tool to "just have a quick look" can break both GxP and privacy rules at once. Use the validated environment.
Know which data you are touching. Is it identifiable PHI, de-identified, or aggregated? The answer changes what you are legally allowed to do with it. When unsure, ask before you query.
Preserve the source. Never overwrite an original value. Transform into new fields and keep the raw data.
Treat privacy and GxP as separate checks. Data can be perfectly de-identified (privacy: good) and still fail data integrity (no audit trail). You need both.
This module is about moving from clinical-trial data to real-world data (RWD): information from routine care, such as insurance claims, electronic health records, and pharmacy data. RWD is messier and often larger, but the same two layers apply. GxP-style integrity expectations increasingly extend to RWD used in regulatory submissions, and privacy law applies fully because RWD often starts as identifiable patient records. The FDA's Real-World Evidence program page is a free starting point.