GMP Record Retention and Archiving

GMP record retention and archiving preserve paper, electronic and hybrid manufacturing and quality records over time. Retention determines the applicable preservation period; archiving provides controlled custody and continued access. Neither means merely moving old files into cheaper storage. These are complementary records-management activities supporting cGMP, not interchangeable storage labels.

A recovery copy alone does not establish a complete long-term archive: restoring a system and preserving a retrievable record serve different purposes. Likewise, a successful migration does not determine how long the transferred records must remain available.

MHRA guidance, section 6.17.1, frames an archive as a designated secure physical area or facility, or a computerised system, for long-term retention of data and metadata. Its scope is therefore not limited to final reports. This framing connects archive design with data integrity, rather than storage capacity alone.

“GxP archiving” and “GxP data archiving” are broader search terminology. They do not mean that GMP retention rules automatically govern every GxP activity; the relevant activity and regulatory scope still matter.

For EU medicinal-product GMP, Chapter 4, paragraph 4.32 states that an inventory of documents within the Quality Management System should be maintained. This is an EU GMP guidance expectation; the archive model below is a practical implementation approach, not a prescribed database schema.

Inventory the business record, not merely its files. A batch record, for example, may span signed paper sheets, electronic entries and linked attachments. Treat these as one record package where they jointly document the activity, while identifying each component separately. Define the package boundary so that an attachment stored elsewhere does not disappear from archive decisions.

Keep accountability separate from custody: the owner is accountable for the record’s business meaning and classification; the custodian manages its storage and access. They may be different teams or organisations. Naming both avoids treating a storage provider as the decision-maker for retention.

Use the manifest to link expected components, identifiers to maintain those relationships, and checksums to support digital file-integrity checks. These are complementary data integrity controls. A matching checksum alone cannot establish that every required component was captured, that the content remains intelligible, or that the retention classification is correct. Record those acceptance decisions against the package rather than inferring them from successful file storage.

Build the retention map by record category, not by archive location or file format. As an industry-practice approach, identify the applicable jurisdiction, product, instrument and triggering event before assigning a period. A batch record, validation dataset and electronic audit trail need not share the same retention basis.

The process-validation dependency matters when one validation exercise supports multiple batches: its raw-data retention follows the supported batch records, rather than only the validation report’s date. For electronic records, assess 21 CFR Part 11 applicability before applying the audit-trail rule.

A retention rule describes a class of records; a retention assignment applies that rule to an individual record using documented lifecycle events. As a scheduling practice, give each assignment enough context for another reviewer to reproduce the decision—not just a date labelled “retain until”.

• Identify the record class, jurisdiction, product scope and rule reference.
• Record the trigger event, actual trigger date and calculated retention boundary.
• List unresolved dependencies, hold status and the authorised reviewer.

If trigger information is missing, keep the assignment unresolved and identify who will obtain it. Uploading a historical batch record does not establish its expiry or certification date; do not substitute the upload date.

Case 1: compare the two batch-documentation boundaries

Assume an EU non-investigational medicinal-product batch expires on 30 June 2030 and received Qualified Person certification on 15 May 2026. Applying the EU GMP guidance in Chapter 4, paragraph 4.11, compare one year after expiry with at least five years after certification and select the longer period. All additions below use calendar years.

The later boundary is 30 June 2031. This example isolates the batch-documentation rule; it is not a destruction authorisation.

Case 2: select the last relevant trial

Assume an EU investigational medicinal-product batch was used in several trials, and the last relevant trial was formally discontinued on 18 September 2032. For this product context, see Annex 13. The separately mapped investigational-product rule in Chapter 4, paragraph 4.11 uses completion or formal discontinuation of the last clinical trial in which the batch was used.

Adding five calendar years gives a boundary of 18 September 2037. The first trial’s end date is not selected because it does not establish the last-trial event. The assignment should identify the trials associated with the batch and the basis for identifying the last one.

Where several retention bases apply, keep each assignment visible and have an authorised reviewer resolve the controlling boundary. Document how corrected dates change calculations, how shared supporting records remain linked to all affected assignments, and how open-ended events remain pending. Taking the maximum of dates is not a substitute for deciding which rules apply.

Use the lifecycle below as a recommended operating model, not a mandated workflow. Name an accountable owner and an authorised decision-maker for every transition in the archive procedure; job titles can vary by organisation.

Lifecycle: classify and assign retention → assemble package → accept custody → maintain access → control changes → authorise disposition.

Build an acceptance record containing the agreed manifest, transfer receipt, reconciliation results, unresolved exceptions, storage location, access arrangements and recorded acceptance. Give each exception an owner and a resolution decision; a receipt alone should not establish package completeness. Keep responsibility with the transferring owner until the custodian records acceptance, with any conditions explicit.

Archive acceptance confirms custody, not product disposition or batch release. Those decisions remain with the separately authorised manufacturing and quality roles.

For GXP archives within its scope, MHRA guidance, section 6.17.1 addresses recovery and readability of both data and metadata throughout the required retention period. It also states that electronic archiving should be validated. As a practical implementation, define validation around the archive’s intended use and technical dependencies rather than assuming one technology or validation approach fits every archive. This connects custody decisions to data integrity, not merely storage capacity.

A visually similar page is not enough to establish a verified copy. UK MHRA guidance, section 6.11.2, defines a true copy through verification by a dated signature or generation through a validated process: it preserves the original information, including context, content and structure. This is a guidance expectation, not a universal retention rule.

The same section expects a true copy to retain the metadata and audit trail needed to preserve meaning and reconstruct history. It also calls for consideration of dynamic functionality throughout retention. Assess dynamic versus static records by the review task: does the reviewer need to query data, examine integration or interact with the underlying record? PDF is neither universally acceptable nor universally unacceptable; assess what the particular export preserves and what it removes.

For a hybrid record system, MHRA guidance, section 6.17.1, expects physical–electronic references to remain usable for full verification throughout retention. For example, link a paper worksheet to its instrument dataset using stable worksheet, sample and run identifiers. Keep those references meaningful when either component moves; a handwritten workstation location alone is a fragile link.

Use record-specific acceptance checks as preservation practice:

• Paper and scans: reconcile page sequence, reverse sides, annotations and attachments. Check legibility, including faint entries and marks near page edges; confirm that the index finds the complete record.
• Paper custody: use controlled checkout to identify the borrower, location and return status without losing the archive reference.
• Electronic records: check units, timestamp interpretation, identifiers and signature context—who signed, when and what the signature applies to. Confirm that required viewers, software versions or other dependencies permit meaningful review, not merely file opening.

Record scanning acceptance separately from disposition authorisation. Acceptance establishes the copy’s suitability; it does not authorise disposal of the paper. Any later destruction decision belongs under the controlled procedure, after applicable retention has ended.

For GXP records within its scope, UK MHRA guidance, section 6.11.2, says that when a computerised system cannot be maintained—for example, because support has ended—records should be archived under a documented archiving strategy before decommissioning. This is guidance, not a universal statutory retention period.

The same section’s discussion of static retention includes verified copies of raw data, metadata, relevant audit trails, result files and variable software/system configuration settings specific to each record. Apply the true-copy distinction covered above when selecting the destination format.

Define acceptance before moving data

As recommended industry practice, make the migration plan an acceptance specification rather than a file-copy instruction. Cover:

• Field mapping, source and destination formats, stable identifiers, parent–child relationships, timestamps with time-zone interpretation, and units.
• Long-term viewing dependencies: software versions, licences, encryption keys, fonts or specialist viewers needed to interpret the archive.
• Manifest reconciliation and representative reconstruction tests demonstrating that users can follow a record’s history and interpret its results.
• Exception handling, recovery responsibilities, rollback criteria and documented acceptance by authorised people before source-system retirement.

Successful transfer proves that files arrived; it does not establish that record meaning survived. Link the migration acceptance decision to the decommissioning plan, keeping the source available for recovery until authorised people accept the destination. Identify how essential viewing dependencies will remain usable after source-system shutdown.

Worked case 3: resolve six exceptions

Assume a migration manifest contains 1,200 batch-record objects, 1,200 audit-trail packages and 2,400 attachments: 4,800 objects in total. The units are archive objects, not batches or individual audit-trail entries. If 4,794 objects import successfully, 4,800 − 4,794 = 6 objects remain unresolved.

Reconcile source and destination identifiers to locate the six exceptions; recover or re-export them, rerun reconciliation and reconstruction checks, and document human acceptance. Reaching 4,800 imported objects still does not prove correct relationships or readability: an attachment could be linked to the wrong record, or a result file could require an unavailable viewer. Resolve those failures before accepting retirement.

As an integration-control practice, map each custody hand-off: manufacturing records from an MES, laboratory results and instrument files, quality-system investigations and approvals, and paper files sent to off-site storage. Where manufacturing and quality systems exchange records, identify which system transfers each record and how related records remain linked in the archive.

Use stable record identifiers, transfer manifests, receiving acknowledgements and reconciliation against expected contents. For paper, connect box and file identifiers to the storage provider’s receipt and location register. A successful transmission message is not proof of archive acceptance: reconcile what arrived, what passed verification and what remains unresolved.

For third-party arrangements within its GXP scope, MHRA data integrity guidance, page 9 says contract givers should include data ownership, governance and accessibility in contracts or technical agreements. This is an official guidance expectation, distinct from the practical transfer controls described here.

Define an exception path for incomplete transfers, duplicate imports, mismatched identifiers, failed verification and unavailable storage:

1. Preserve the source and contain the affected transfer; do not mark it accepted.
2. Assign an owner to investigate, coordinate escalation and authorise a controlled retry without creating unresolved duplicates.
3. Reconcile the retried transfer before an authorised person accepts it.

As supplier-exit planning practice, agree export access, format dependencies and responsibility for recovery and escalation. Set local service levels according to operational risk rather than assuming a universal deadline.

For US closed systems within 21 CFR Part 11 scope, 11.10(c) lists "Protection of records to enable their accurate and ready retrieval throughout the records retention period." 11.10(b) requires the ability to generate accurate, complete copies in both human-readable and electronic forms suitable for agency inspection, review and copying. For Part 211 drug records, 21 CFR 211.180(c) requires records or copies to be readily available for authorized inspection during the retention period, and states that "Records that can be immediately retrieved from another location by computer or other electronic means shall be considered as meeting the requirements of this paragraph." Retrieval tests should therefore prove retrieval within an inspection, not merely that a file exists somewhere.

UK MHRA GXP guidance, section 6.17.1, expects periodic verification that legacy-system data remain reviewable. It does not specify a fixed monthly, quarterly or annual interval.

As industry practice, run a representative retrieval exercise from identifier lookup through complete record review, not merely successful file download. Set coverage and frequency through documented risk assessment, considering record criticality, age, media and technical dependencies. Include a hybrid record system where relevant. Record elapsed retrieval time, completeness, readability, copy-generation results and exceptions against predefined acceptance criteria.

Treat these as recommended failure controls, not prescribed test methods. Assign each failed test an owner, assess affected records and repeat the exercise after correction before closing the issue.

MHRA’s GxP guidance says destruction procedures should consider data criticality and, where applicable, legislative retention requirements; see the data retention discussion on page 17. This is guidance, not a universal retention period.

As a conservative archive practice, destroy records only after applicable retention ends, under a documented procedure and with authorisation by designated people. A calculated date creates a review candidate—not permission for unattended deletion. Before approval, check unresolved retention triggers, holds, investigations and shared-record dependencies. For example, confirm whether an open out-of-specification investigation still needs the proposed records; do not treat elapsed time as sufficient authority.

Keep a destruction record identifying what was destroyed, the authority for disposal, method, date, responsible people and completion evidence. The procedure should address managed replicas and vendor-held copies, not just the primary archive. Track any unresolved copy disposition explicitly, with an owner and follow-up action, rather than marking the entire disposal complete when only one location has been cleared.

Use this recommended checklist at archive review; assign each unresolved action to the named role.

Revisit affected decisions after a new market or product type, changed source-system support, altered record format, supplier transition, failed retrieval or corrected retention trigger. These are change-driven prompts, not a universal review interval.