In the pharmaceutical industry, GDP can stand for two related disciplines. Good Documentation Practice, often shortened to GDocP, is the GxP discipline governing how pharmaceutical records are created, corrected, reviewed, and retained. Good Distribution Practice is the set of standards governing how medicines are stored, transported, and handled once they leave the manufacturer.

Both answer the same question for a regulator: can you prove, with evidence, that a medicine is what it claims to be? Documentation carries most of that weight. Good Manufacturing Practice (GMP), Good Clinical Practice (GCP), and Good Laboratory Practice (GLP) cannot be achieved without strictly following Good Documentation Practice, because an inspector can only assess what has been recorded. If it is not documented, it did not happen.

This article covers both. To keep the terms distinct, it uses GDocP for Good Documentation Practice and GDP for Good Distribution Practice. The first part explains where GDocP requirements come from, the ALCOA+ principles behind them, who is responsible and what happens when compliance fails. The second part explains what Good Distribution Practice covers, its key principles and who needs to comply.

Where do Good Documentation Practice (GDocP) requirements come from?

GDocP sits within the broader GxP framework alongside Good Manufacturing Practice (GMP), Good Laboratory Practice (GLP), Good Clinical Practice (GCP), and Good Pharmacovigilance Practice (GVP). Each of these disciplines depends on reliable records, so documentation requirements appear in all of them.

There is no single standalone “GDocP regulation.” Instead, documentation expectations are woven through quality-system requirements and data integrity guidance issued by each regulator. The most frequently referenced sources include:

  • United States: The FDA’s current good manufacturing practice regulations in 21 CFR Parts 210 and 211, which set requirements for batch production and control records, laboratory records, and record retention, together with 21 CFR Part 11 for electronic records and electronic signatures. The FDA’s 2018 guidance, Data Integrity and Compliance With Drug CGMP, explains how the agency interprets these requirements.
  • European Union: Chapter 4 (Documentation) of the EU GMP Guide in EudraLex Volume 4, and Annex 11, which covers computerized systems. The European Commission published draft revisions of both for consultation in July 2025, alongside a new Annex 22 on artificial intelligence. As of today’s publication date in October 2026 these have not yet been adopted, but the final versions are due.
  • United Kingdom: the MHRA’s GXP Data Integrity Guidance and Definitions, published in 2018, which applies across all GxP disciplines.
  • International: PIC/S guidance PI 041-1 on good practices for data management and integrity in regulated GMP and GDP environments, and the WHO guideline on data integrity.

For QA and regulatory teams, the practical consequence is that GDocP is not defined in one place and does not stand still. Expectations are interpreted through inspections and refreshed through new guidance, so internal SOPs need regular review against the current texts.

What are the ALCOA+ principles of GDP?

ALCOA+ is the operational backbone of Good Documentation Practice. The original ALCOA acronym describes five attributes that every record should have: attributable, legible, contemporaneous, original, and accurate. The “plus” adds four more: complete, consistent, enduring, and available. The FDA, the MHRA, PIC/S, and WHO all reference these attributes in their data integrity guidance, and they apply equally to paper and electronic records. Some newer guidance, including the EU’s draft revision of Chapter 4, extends the set further to ALCOA++ by adding traceability.

The table below sets out what each GDocP principle means in practice.

Principle What it means in practice
Attributable Every entry is clearly tied to the person (and, for electronic records, the system or login) that created or changed it. No shared logins, no unsigned entries.
Legible Records stay readable for the whole retention period, on paper and on screen, with corrections made so the original entry is still visible underneath.
Contemporaneous Data is recorded at the time the activity happens, not reconstructed afterwards from memory or a rough note.
Original The first recorded version (or a verified true copy) is what is kept and relied on, not a rewritten or re-transcribed version.
Accurate Entries correctly and completely reflect what was actually done, checked, and verified, with no unexplained edits.
Complete All data needed to reconstruct an activity is present, including repeat testing, changes, and the reasons for them.
Consistent Records are created and sequenced in a logical, chronological order that matches the process being documented.
Enduring Records are durable enough to remain intact and legible for their full required retention period, on the original medium.
Available Records can be retrieved, reviewed, and audited for their entire retention period, including by inspectors.

 

On the shop floor and in the laboratory, these principles translate into a small set of everyday habits: record in permanent ink, never in pencil or on scrap paper; correct errors with a single line so the original remains readable, then initial, date and give a reason; never use correction fluid or overwrite; line through unused spaces so nothing can be added later; and review audit trails as part of routine record review, not only before an inspection.

Why is GDocP important in the pharmaceutical industry?

Good Documentation Practice is not an administrative overhead. It is the evidence base that every quality and regulatory decision rests on. Its importance comes down to five areas:

  • Patient safety. Accurate records underpin every quality decision, from batch release to recall. If a batch record is incomplete or unreliable, there is no sound basis for releasing the product, investigating a complaint or tracing affected batches.
  • Data integrity as the foundation of trust in regulatory submissions. Regulators approve products and accept variations based on the data you submit. If the records behind that data cannot be trusted, neither can the submission.
  • Audit and inspection defensibility. Inspectors test what you say against what you recorded. Well-kept records let your team answer questions quickly and with evidence, which is central to GxP audit and inspection readiness.
  • Legal and commercial risk. Documentation failures can lead to enforcement action, delayed approvals, supply interruptions, and reputational damage with partners and customers.
  • Operational efficiency. Good records prevent repeat investigations and reduce time lost to unexplained deviations. When the data is complete the first time, root-cause analysis is faster and corrective actions are easier to verify.

Who is responsible for GDocP compliance?

Everyone who creates, reviews, or approves a GxP record shares responsibility for its quality, and senior management is accountable for providing the systems, training, and resources that make compliance possible. Within that, four groups carry specific responsibilities:

  • QA/QC teams, who write and enforce documentation SOPs and run internal audits. They set the standard, review records and track documentation-related deviations and CAPAs.
  • Manufacturing and production staff, who complete records at the point of activity. Contemporaneous, accurate recording on the shop floor is where GDocP succeeds or fails.
  • IT and data governance teams, who manage electronic systems and audit trails. They make sure systems are validated, access is controlled at user level and audit trails are switched on and reviewable.
  • Regulatory affairs and regulatory intelligence teams, who monitor evolving agency expectations. They translate new or revised guidance into changes the business needs to make to SOPs and training.

What are the common challenges of GDocP compliance?

Most GDocP failures are not deliberate. They come from systems and habits that make good practice harder than it should be. The most common challenges are:

  • Reliance on paper-based or hybrid paper/electronic systems that make contemporaneous recording difficult. When data moves between paper and screen, transcription errors and gaps in attribution follow.
  • Backdating or “documenting from memory.” Completing records after the event, even with good intentions, breaks the contemporaneous principle and undermines the reliability of the whole record.
  • Lack of staff training on data integrity expectations; legacy systems without proper audit trails or user-level attribution. Staff need to understand why the rules exist, and systems need to support them, not work around them.
  • Difficulty keeping SOPs current with evolving MHRA, PIC/S, and WHO guidance. Guidance is updated on different timelines by different bodies, and gaps between current expectations and internal procedures often go unnoticed until an inspection.

These gaps tend to surface at the worst possible moment. Building inspection readiness into routine operations, rather than treating it as a pre-inspection exercise, is the most reliable way to find and close them early.

What happens when GDocP compliance fails?

The consequences escalate. The FDA Form 483 observations and warning letters citing data integrity or documentation failures are among the most common inspection findings, and consequences can escalate to import alerts and product recalls.

A typical escalation path looks like this:

  • Form 483 observations issued at the close of an FDA inspection, listing conditions the investigator considers objectionable.
  • Warning letters, published by the FDA, when responses to observations are inadequate or the issues are significant.
  • Import alerts, which allow the FDA to detain products from affected sites without physical examination.
  • Product recalls, when records cannot demonstrate that released batches meet their specifications.

European and UK regulators have comparable tools, including GMP non-compliance statements and the suspension of manufacturing or wholesale authorizations. The pattern of findings across the industry is also a useful signal: the documentation failures cited at other sites today are often the questions your inspectors will ask tomorrow.

Infodesk’s Inspection and Enforcement Intelligence helps your team track these enforcement patterns across agencies and reduce the time spent preparing for inspections, so you can address emerging issues before they appear in your own findings.

What is Good Distribution Practice (GDP)?

Good Distribution Practice is the set of quality standards ensuring medicines are stored, transported, and handled correctly throughout the supply chain, from manufacturer to pharmacy. Its purpose is to make sure the quality established at manufacture is maintained until the product reaches the patient, and that falsified medicines do not enter the legal supply chain.

GDP applies to wholesale distributors, not only logistics providers, and covers the full chain of custody. In the EU, it is legally mandated under the Guidelines on Good Distribution Practice of medicinal products for human use (2013/C 343/01). WHO publishes equivalent guidance on good storage and distribution practices that is used globally, and in the UK, GDP is enforced by the MHRA.

Key principles of Good Distribution Practice

GDP is built on a small number of principles that together protect product quality from the moment a medicine leaves the manufacturer. The table below summarizes what each one covers.

Principle What it covers
Quality management system A documented system with a named Responsible Person accountable for GDP compliance and for approving any subcontracted distribution activity.
Storage conditions Facilities qualified and temperature-mapped to identify hot/cold spots, with risk-based sensor placement and segregation to prevent contamination or mix-ups.
Transportation Transport lanes qualified end-to-end, with continuous temperature monitoring and documented handovers at every point the product changes custody.
Documentation & traceability Auditable records covering mapping protocols, monitoring reports, calibration certificates, and deviation investigations.
Personnel & training Staff trained to a documented standard and assessed for competence, so procedures are followed consistently regardless of who is on shift.
Recalls & complaints A tested procedure for tracing and recalling affected batches quickly, and for capturing and investigating distribution-related complaints.

 

Documentation and traceability is where GDP and GDocP meet: temperature logs, handover records and deviation reports in the supply chain are held to the same ALCOA+ principles as batch records in manufacturing.

Who needs to comply with GDP?

GDP obligations follow the product, not the type of company. Any organization that procures, holds, supplies, or exports medicines as part of distribution needs to comply, including:

  • Wholesale distribution authorization holders
  • Manufacturers when acting as their own distributor
  • Importers and exporters
  • Third-party logistics providers handling medicines on a client’s behalf.

Where activities are outsourced, responsibility is not. The authorization holder remains accountable for making sure subcontracted storage and transport meet GDP requirements.

How Infodesk supports GDocP and GDP compliance

GDocP and GDP expectations are set by many regulators, on different timelines, and they continue to evolve. For QA and regulatory teams, the challenge is not only meeting today’s requirements but knowing when they change. Learn more about how Infodesk supports quality assurance and GxP teams.

Infodesk supports end-to-end GDocP and GDP compliance with intelligence activation across three solutions which reflect the surveillance to action steps of the QA workflow:

Regulatory surveillance

Infodesk’s regulatory intelligence platform is the surveillance layer that keeps QA and regulatory teams ahead of evolving documentation and data integrity guidance from the FDA, the EMA, MHRA, PIC/S, and WHO.

I&E monitoring

Infodesk’s Inspection & Enforcement Intelligence solution gives you a database of the inspector’s history, your site’s full record, and the findings escalating right now. Inspection and Enforcement Intelligence (I&E Intelligence) pulls every inspection record and enforcement action into one place across seven health authorities, then turns it into the profiles, briefs, and reports your team needs to prepare. This way inspection findings from elsewhere in the industry become early-warning signals rather than surprises and you can always be inspection-ready.

Action

Infodesk’s Workflow Solution ensures curated, validated intelligence is delivered directly into your workflows, so impact assessments can be easily managed and SOPs and training stay current.

Infodesk gives you the clarity, confidence and proof to act, when action matters most. To see how Infodesk can support your GDocP and GDP programs, book a meeting with our team.