Skip to content
GxP Validation Assistant

The UK package · United Kingdom

The UK's GMP rules for computerised systems and the MHRA's data integrity guidance, on the international core.

For sites inspected by the MHRA. In the UK, Annex 11 on computerised systems, Chapter 4 on documentation, Chapter 7 on outsourced activities and Annex 15 on qualification remain part of the GMP guidance the MHRA publishes; the package adds them to the core with the MHRA's GxP data integrity guidance, and offers UK data protection as an overlay.

PricingWatch the webinar
Regulators
MHRA
Languages
English
Paper
A4

  • Data integrity the MHRA way

    The MHRA's GxP data integrity guidance as a rule pack: data governance, audit trail review, administrator access, true copies, cloud services.

  • UK data protection as an overlay

    The UK GDPR and the Data Protection Act 2018 obligations IT implements, documents or contracts for, with their records.

  • A UK annex, not a second method

    An annex SOP sets out what the UK adds to the global procedures; the department profile names the Qualified Person who certifies batches.

Contents

What the UK package contains

The core and the package's own rule packs, by status. Each rule is paraphrased with its section number, cites its source and names its status; documents name the packs they are written against.

UK package

  • Annex 11 (2011) + Chapter 4 (2011)

    Version 2011-06-30 v3.1 · 47 rules

    In force

  • EU GMP Annex 15 (2015): qualification of IT infrastructure and systems

    Version 2015-10-01 v3.1 · 18 rules

    In force

  • EU GMP Chapter 7 (2013): outsourced activities, applied to IT services

    Version 2013-01-31 v3.1 · 13 rules

    In force

  • MHRA GxP data integrity guidance and definitions (2018)

    Version 2018-03 v3 · 25 rules

    Guidance

International core

  • ICH Q10 (2008): pharmaceutical quality system

    Version 2008-06-04 v3.1 · 7 rules

    Guidance

  • ICH Q9(R1) (2023): quality risk management

    Version 2023-01-18 v3.1 · 10 rules

    Guidance

  • PIC/S PI 011-3: good practices for computerised systems (2007)

    Version 2007-09-25 v3.1 · 24 rules

    Guidance

  • PIC/S PI 041-1: data management and integrity (2021)

    Version 2021-07-01 v3.1 · 30 rules

    Guidance

  • WHO guideline on data integrity (TRS 1033, Annex 4, 2021)

    Version 2021 v3 · 26 rules

    Guidance

Overlays, included

Switched on in setup where they apply to you; recommended ones are preselected.

  • Data protection

    recommended

    Personal data in GxP systems: records of processing, processors, technical and organisational measures, impact assessments, breaches and data subject requests.

    • UK GDPR and Data Protection Act 2018: IT obligations

      Version 2026-10-05 v1 · 49 rules

      In force

SOP set

26 global procedures and 1 annex procedure for the package, adopted as drafts in setup, each citing the rules it covers. Overlays add their own procedures.

The UK package

One licence covers one installation and the package you buy, with every overlay that package offers. Try it first: every installation runs 14 days without a licence.

Every licence includes

  • The program for Windows and Linux with checksums; a Docker image for a server on request
  • The international core and the package you buy, with all its overlays
  • English and the package's local languages, for the interface and the documents
  • Your licence key straight away in the licence portal, for the installation ID you enter
  • After the included update period: support and updates as a yearly subscription you can end at any time

Questions about the UK package

Why does the UK package contain the Annex 11 text?

Because it still applies in the UK: Annex 11 and the related chapters are part of the GMP guidance the MHRA publishes. The package uses the same rule pack as the EU; the EU's 2025 draft revision is not part of the UK package.

Is the MHRA data integrity guidance binding?

It is guidance and labelled as such. It explains how the MHRA reads the existing GxP requirements for data, which is why inspectors refer to it.

Which data protection law does the overlay follow?

The UK GDPR and the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, with the obligations IT implements, documents or contracts for.

Topics

Find out in one session whether it fits your department.

The webinar walks through setup, a system from intended use to release, the documents and the IT controls that keep it validated.

Choose a time