Introduction:
GMP Data Integrity for Extractables and Leachables Testing has become one of the most important compliance requirements in pharmaceutical analytical laboratories. Regulatory agencies expect every chromatogram, spectrum, analytical report, calculation, and electronic record generated during Extractables and Leachables (E&L) studies to be trustworthy, traceable, and protected against unauthorized modification.
As pharmaceutical packaging and delivery systems grow more complex — prefilled syringes, autoinjectors, inhalation devices, ophthalmic containers, PLGA-based injectable systems, infusion systems, and combination products — the quality of E&L data for container closure systems has a direct bearing on patient safety and regulatory approval timelines. Because these studies identify chemicals that may migrate from packaging or device components into a drug product, agencies require complete confidence in the authenticity of the underlying data before they will accept the conclusions drawn from it.
This article explains how 21 CFR Part 11 supports GMP laboratories, why data integrity is critical for E&L testing, common regulatory expectations, implementation strategies, and best practices for maintaining inspection-ready laboratory operations.
Summary:
- Data integrity is a fundamental requirement for regulatory acceptance of Extractables and Leachables (E&L) studies.
- 21 CFR Part 11 establishes requirements for electronic records and electronic signatures used in GMP laboratories.
- Maintaining GMP Data Integrity for Extractables and Leachables Testing ensures that analytical results remain accurate, complete, attributable, and audit-ready.
- Regulatory agencies including the FDA, Health Canada, EMA, and MHRA closely inspect laboratory data integrity practices during GMP inspections.
- Secure Laboratory Information Management Systems (LIMS), chromatography data systems (CDS), validated software, audit trails, controlled access, and electronic signatures are essential components of compliance.
- A robust data integrity program minimizes regulatory observations, protects product quality, and accelerates regulatory submissions.
- ResolveMass Laboratories Inc. follows scientifically rigorous analytical workflows and documentation practices to generate reliable E&L data suitable for global regulatory submissions.
1: What Is Data Integrity in a GMP Laboratory?
Data integrity means ensuring that all laboratory data are complete, accurate, consistent, reliable, and attributable throughout their entire lifecycle.
In a GMP environment, data integrity applies to every stage of analytical testing, including:
- Sample receipt
- Sample preparation
- Instrument operation
- Chromatographic acquisition
- Mass spectrometry analysis
- Data processing
- Review and approval
- Report generation
- Data archiving
In a GMP environment, this standard applies to every stage of analytical testing, including sample receipt, sample preparation, instrument operation, chromatographic or spectral acquisition, data processing, review and approval, report generation, and long-term archiving. For an E&L laboratory specifically, that lifecycle touches data from LC-MS/MS, LC-HRMS, GC-MS/MS, GC-HRMS, ICP-MS, FTIR, and UV spectroscopy, along with the supporting laboratory notebooks, electronic worksheets, and instrument audit trails behind each result. A single undocumented gap — a missing raw file, an unexplained reprocessing event, an unreviewed audit trail entry — can compromise the credibility of an entire study, regardless of how sound the underlying science is. For a closer look at how these controls apply specifically to E&L work, see our overview of data integrity in extractables and leachables testing.
For Extractables and Leachables testing, this includes information generated from:
- LC-MS/MS
- LC-HRMS
- GC-MS/MS
- GC-HRMS
- ICP-MS
- FTIR
- UV spectroscopy
- Sample preparation records
- Laboratory notebooks
- Electronic worksheets
- Instrument audit trails
Even a small gap in documentation may compromise the credibility of an entire study.
2: What Is 21 CFR Part 11?
21 CFR Part 11 is the U.S. FDA regulation governing electronic records and electronic signatures used in FDA-regulated industries.
Its objective is to ensure that electronic records are as trustworthy as traditional paper documentation.
The regulation applies whenever laboratories use computerized systems such as:
- Chromatography Data Systems (CDS)
- Laboratory Information Management Systems (LIMS)
- Electronic Laboratory Notebooks (ELN)
- Instrument software
- Electronic quality management systems
- Document management platforms
Part 11 ensures that electronic data cannot be altered without detection and that every action performed within the system is traceable.
3: Why Is Data Integrity Critical for Extractables and Leachables Testing?
Extractables and Leachables studies evaluate chemicals that migrate from packaging materials into pharmaceutical products. These studies directly support patient safety and regulatory submissions.
Weak data integrity practices in this setting can lead to incorrect identification of leachables, false positive or false negative findings, missed toxicological risks, invalid analytical reports, FDA Form 483 observations, warning letters, delayed approvals, repeat studies, and materially higher development costs. Because E&L studies support risk decisions that ultimately protect patients from packaging- or device-derived chemical exposure, regulators expect a correspondingly higher standard of documentation and traceability than in many other GMP testing contexts — a standard mirrored in data integrity practices for bioanalytical studies, where trace-level results carry the same regulatory weight.
Poor laboratory data integrity may result in:
- Incorrect identification of leachables
- False positive findings
- Missed toxicological risks
- Invalid analytical reports
- FDA Form 483 observations
- Warning letters
- Delayed product approvals
- Repeat analytical studies
- Increased development costs
Because E&L studies often involve ultra-trace level detection (ppb to ppt), regulators expect exceptional documentation and complete traceability for every analytical result.
4: ALCOA+ Principles: The Foundation of GMP Data Integrity
The pharmaceutical industry follows the internationally recognized ALCOA+ principles.
| Principle | Meaning | Application in E&L Testing |
|---|---|---|
| Attributable | Identify who performed each action | Analyst login and electronic signature |
| Legible | Data remain readable | Electronic reports and raw files |
| Contemporaneous | Record data immediately | Real-time acquisition during LC-MS analysis |
| Original | Preserve original raw data | Native chromatograms and spectra |
| Accurate | Data must be correct | Verified calculations and review |
| Complete | Include all records | Audit trails and failed runs |
| Consistent | Proper sequence maintained | Time-stamped workflows |
| Enduring | Long-term preservation | Secure electronic archives |
| Available | Easily retrievable | Inspection-ready databases |
Every E&L laboratory should build its quality system around these principles.
5: How Does 21 CFR Part 11 Apply to an E&L Laboratory?
A GMP Extractables and Leachables laboratory generates thousands of electronic records every month.
Examples include:
Instrument Data
- LC-MS chromatograms
- GC-MS chromatograms
- Mass spectra
- Calibration curves
- Sequence tables
Laboratory Documentation
- Sample receipt logs
- Preparation worksheets
- Extraction protocols
- Instrument maintenance records
- Method validation reports
Quality Documentation
- SOP approvals
- Deviations
- CAPA records
- Change controls
- Stability reports
Each electronic record must be protected throughout its lifecycle.
6: Essential Components of a Part 11-Compliant E&L Laboratory
A Part 11-compliant E&L laboratory is built on five core technical controls: secure user access, verified electronic signatures, tamper-evident audit trails, validated computerized systems, and reliable data backup and recovery.
1. Secure User Access
Every analyst should have a unique username, an individual password, clearly defined user roles, restricted access aligned to those roles, and automatic session timeout. Shared logins should never be permitted, since they break the attributability that Part 11 and ALCOA+ both depend on.
Every analyst should have:
- Unique username
- Individual password
- Defined user roles
- Access restrictions
- Automatic session timeout
Shared logins should never be permitted.
2. Electronic Signatures
A compliant electronic signature must be unique to the signer, legally equivalent to a handwritten signature, and permanently linked to the record it approves — capturing signer identity, date, time, and the meaning of the approval (review, authorship, or authorization).
Electronic signatures should:
- Be unique
- Be legally equivalent to handwritten signatures
- Record signer identity
- Include date and time
- Capture approval purpose
This ensures accountability during GMP operations.
3. Audit Trails
Audit trails should automatically and continuously capture data creation, modification, deletion attempts, reprocessing events, and general user activity. They must never be capable of being disabled by end users, and they should be reviewed on a routine, documented basis rather than only during an inspection.
Audit trails automatically record:
- Data creation
- Data modification
- Record deletion attempts
- Reprocessing events
- User activities
Audit trails should never be disabled.
4. System Validation
Every computerized system supporting E&L testing — LIMS, CDS, ELN, instrument control software, and statistical software — should undergo validation demonstrating it performs as intended, typically through Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ).
Every computerized system used for E&L testing should undergo validation demonstrating that it performs as intended.
Typical validated systems include:
- LIMS
- CDS
- ELN
- Instrument control software
- Statistical software
Validation includes Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ).
5. Data Backup and Recovery
Reliable backup procedures should include automated daily backups, off-site or redundant storage, a documented disaster recovery plan, and periodic restoration testing. Loss of raw analytical data can invalidate an entire study, so recoverability has to be proven, not assumed.
Reliable backup procedures should include:
- Automated daily backups
- Off-site storage
- Disaster recovery plans
- Periodic restoration testing
Loss of raw analytical data can invalidate an entire study.
7: Best Practices for Maintaining GMP Data Integrity for Extractables and Leachables Testing
A mature laboratory quality system incorporates multiple layers of protection.
Laboratory Best Practices
- Standardized SOPs
- Controlled documentation
- Regular staff training
- Independent data review
- Electronic workflow validation
- Controlled instrument configuration
- Routine audit trail review
- Periodic software qualification
- Cybersecurity controls
- Risk assessments
Together, these practices strengthen GMP Data Integrity for Extractables and Leachables Testing and improve inspection readiness.
8: Common Regulatory Observations Related to Data Integrity
Regulatory agencies frequently identify recurring deficiencies during GMP inspections.
The most common data integrity observations cited by FDA, Health Canada, EMA, and MHRA inspectors are shared analyst accounts, disabled audit trails, missing raw files, unauthorized data deletion, unvalidated software, incomplete review processes, poor backup procedures, and missing electronic signatures.
| Observation | Regulatory Concern |
|---|---|
| Shared analyst accounts | No individual accountability for actions taken |
| Disabled audit trails | Potential for undetected data manipulation |
| Missing raw files | Incomplete, non-reconstructable records |
| Unauthorized data deletion | Loss of traceability and original data |
| Unvalidated software | Questionable reliability of generated results |
| Incomplete review process | Elevated compliance and quality risk |
| Poor backup procedures | Risk of unrecoverable data loss |
| Missing electronic signatures | Non-compliance with Part 11 signature requirements |
Preventing these findings requires proactive, ongoing quality management — routine audit trail review, periodic software qualification checks, and internal self-inspection — rather than corrective action taken only after an inspection has already surfaced the gap.
9: Technologies That Support Data Integrity
Modern analytical laboratories increasingly use digital technologies to strengthen compliance.
Examples include:
- Laboratory Information Management Systems (LIMS)
- Chromatography Data Systems (CDS)
- Electronic Laboratory Notebooks (ELN)
- Secure cloud-based archives
- Automated audit trail monitoring
- Instrument integration platforms
- Barcode-enabled sample tracking
- Role-based electronic workflows
These technologies reduce manual transcription errors while improving operational efficiency.
10: Data Integrity Challenges in High-Resolution Mass Spectrometry
Extractables and Leachables studies often generate extremely large HRMS datasets.
Challenges include:
- Multiple terabytes of raw data
- Complex spectral processing
- Unknown compound identification
- Automated library searching
- Software version control
- Reprocessing documentation
Key challenges include managing large volumes of raw HRMS data, documenting complex spectral processing steps, supporting unknown compound identification with defensible library searches, controlling automated library-matching parameters, maintaining software version control across processing campaigns, and fully documenting any reprocessing activity — challenges that parallel those seen in mass spectrometry characterization of peptide and oligonucleotide conjugates, where high-resolution data volumes are similarly large. Every reprocessed dataset should remain fully traceable back to its original raw files, with the audit trail intact, so a reviewer or inspector can reconstruct exactly how a reported result was derived.
Every reprocessed dataset should remain fully traceable with preserved original raw files and complete audit trails.
11: Preparing for FDA and Global Regulatory Inspections
Inspection readiness should be a continuous process rather than a last-minute activity.
A GMP E&L laboratory should routinely verify:
- SOP compliance
- Training records
- Instrument qualification
- Software validation
- Audit trail review
- Backup verification
- Electronic signature compliance
- Data lifecycle management
- Change control documentation
- CAPA effectiveness
Inspection readiness is achieved through daily discipline rather than periodic preparation.
12: Building a Strong Data Integrity Culture
Technology alone cannot ensure compliance.
Organizations should promote a culture where employees understand that:
- Patient safety depends on accurate data.
- Every laboratory record contributes to regulatory confidence.
- Transparency is more valuable than hiding errors.
- Deviations should be documented rather than ignored.
- Continuous improvement strengthens long-term compliance.
Leadership commitment, employee training, and quality oversight together create a sustainable data integrity program.
13: How ResolveMass Laboratories Inc. Supports Data Integrity in E&L Testing
At ResolveMass Laboratories Inc., data integrity is integrated throughout the analytical workflow for Extractables and Leachables studies. From controlled sample handling and validated analytical methods to secure electronic data management and comprehensive technical documentation, every stage is designed to support reliable, reproducible, and inspection-ready results.
Using LC-MS/MS, LC-HRMS, GC-MS/MS, GC-HRMS, and ICP-MS across a validated analytical platform, ResolveMass generates E&L data suitable for submission to FDA, Health Canada, and EMA. Comprehensive documentation, method validation, independent quality review, and fully traceable reporting are applied consistently across studies, giving sponsors a data package that can withstand regulatory scrutiny and support confident product development and lifecycle management decisions. The same documentation discipline carries through our work on peptide characterization CRO deliverables and comparability exercises in biosimilar development, where sponsors depend on equally rigorous, audit-ready data packages.
Conclusion:
Maintaining GMP Data Integrity for Extractables and Leachables Testing is far more than a regulatory obligation—it is a critical element of pharmaceutical quality and patient safety. By implementing the principles of 21 CFR Part 11, following ALCOA+ practices, validating computerized systems, securing electronic records, and fostering a culture of accountability, GMP laboratories can produce trustworthy E&L data that withstands regulatory scrutiny.
As packaging systems, analytical technologies, and regulatory expectations continue to evolve, organizations that invest in robust data integrity programs will be better positioned to accelerate submissions, reduce compliance risks, and deliver safe, high-quality pharmaceutical products to patients worldwide.
Frequently Asked Questions:
Data integrity in Extractables and Leachables (E&L) testing refers to maintaining complete, accurate, consistent, and traceable laboratory records throughout the testing process. It ensures that every sample, chromatogram, mass spectrum, calculation, and report remains authentic and protected from unauthorized changes. Strong data integrity practices help laboratories generate reliable results that support pharmaceutical product safety and regulatory submissions.
21 CFR Part 11 establishes FDA requirements for electronic records and electronic signatures used in GMP laboratories. It ensures that digital laboratory data are secure, traceable, and equivalent to paper records. Compliance is essential because most modern E&L laboratories rely on computerized systems such as LIMS, Chromatography Data Systems (CDS), and Electronic Laboratory Notebooks (ELN) to manage analytical data.
ALCOA+ is a globally recognized framework that ensures laboratory data are Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, and Available. These principles guide pharmaceutical laboratories in maintaining trustworthy analytical records throughout the entire data lifecycle and are routinely assessed during regulatory inspections.
Audit trails automatically record every action performed within laboratory software, including data creation, modifications, reprocessing, approvals, and user activities. They provide complete traceability of analytical records and help regulators verify that no unauthorized changes have occurred. Reviewing audit trails regularly is an important part of maintaining GMP compliance.
FDA inspectors frequently observe issues such as shared user accounts, disabled audit trails, missing raw analytical data, incomplete documentation, unvalidated software, weak password controls, and inadequate review of electronic records. These deficiencies can lead to Form 483 observations, warning letters, or delays in product approvals if not addressed through effective quality systems.
LC-MS and GC-MS analyses often detect extractables and leachables at extremely low concentrations, making accurate data handling critical. Even minor errors in data acquisition, processing, or reporting can affect compound identification and toxicological risk assessments. Maintaining robust data integrity ensures confidence in analytical results used for regulatory submissions and patient safety evaluations.
GMP establishes the overall quality framework for pharmaceutical manufacturing and laboratory operations, while 21 CFR Part 11 provides specific requirements for electronic records and electronic signatures. Data integrity serves as the foundation that connects these regulations by ensuring laboratory data remain complete, accurate, secure, and traceable throughout their lifecycle.
Reference
- Vas G, Fleck L, Comstock K, Cole J. Extractable and leachable testing for pharmaceutical packaging, finished pharmaceutical products, and medical devices: An analytical perspective. Curr Trend Mass Spectrom. 2020:5-14. https://www.chromatographyonline.com/view/extractable-and-leachable-testing-for-pharmaceutical-packaging-finished-pharmaceutical-products
- Ramamoorthy S, Chong NS, Hotha KK. Strengthening extractable & leachable study submissions: best practices to avoid regulatory deficiencies. American Journal of Analytical Chemistry. 2024;15(12):368-94.https://www.researchgate.net/profile/Subathra-Ramamoorthy-2/publication/387503864_Strengthening_Extractable_Leachable_Study_Submissions_Best_Practices_to_Avoid_Regulatory_Deficiencies/links/678dbc981ec9f9589f51a2bb/Strengthening-Extractable-Leachable-Study-Submissions-Best-Practices-to-Avoid-Regulatory-Deficiencies.pdf
- Wakankar AA, Wang YJ, Canova‐Davis E, Ma S, Schmalzing D, Grieco J, Milby T, Reynolds T, Mazzarella K, Hoff E, Gomez S. On developing a process for conducting extractable–leachable assessment of components used for storage of biopharmaceuticals. Journal of pharmaceutical sciences. 2010 May 1;99(5):2209-18.https://www.sciencedirect.com/science/article/pii/S0022354915326563
- Sobańtka A, Weiner C. Extractables/Leachables from Single‐Use Equipment: Considerations from a (Bio) Pharmaceutical Manufacturer. Single‐Use Technology in Biopharmaceutical Manufacture. 2019 Aug 5:143-58.https://onlinelibrary.wiley.com/doi/abs/10.1002/9781119477891.ch11
- Vas G, Fleck L, Michelson A, Dunn N, Duett J, Cali J. Importance of a High Performing GC-MS Based Screening Method for Testing Stability Samples for Volatile and SemiVolatile Leachable Impurities. Rev. Sep. Sci. 2021:3-20.https://www.researchgate.net/profile/Gyorgy-Vas-2/publication/349858456_Importance_of_a_High_Performing_GC-MS_Based_Screening_Method_for_Testing_Stability_Samples_for_Volatile_and_Semi-Volatile_Leachable_Impurities/links/606b2da0458515614d3a2264/Importance-of-a-High-Performing-GC-MS-Based-Screening-Method-for-Testing-Stability-Samples-for-Volatile-and-Semi-Volatile-Leachable-Impurities.pdf
About the Author
