Sponsored by Syngene

A clinical trial may have a sound protocol and capable investigators. Still, it can fail if its data cannot be trusted. The ALCOA principles provide the basic framework for protecting data integrity in clinical trials. However, maintaining reliable data now involves much more than correct site documentation. Clinical trial data management depends on electronic systems, laboratories, digital devices, cloud platforms, and external vendors. The BIOSECURE Act adds another concern by asking sponsors to understand who handles sensitive biological data, which technologies are used, and where the data move.

Data integrity has therefore moved beyond quality control. Trials depend on electronic data capture, laboratories, imaging vendors, electronic patient-reported outcomes, wearable devices, and cloud platforms. Data may pass through several organizations and countries before processing is completed and the database is locked. Every handoff is another place where context or control may be lost.

The BIOSECURE Act adds a further concern. It asks sponsors to look at who handles sensitive biological data, what equipment and software are used, where data are stored, and how far subcontracting extends. It does not replace Good Clinical Practice. It changes the wider risk picture around trusted clinical data.

The established ALCOA plus principles remain a useful test. Data should be attributable, legible, contemporaneous, original and accurate. They should also be complete, consistent, enduring and available. The UK Medicines and Healthcare products Regulatory Agency explains that the plus elements make the original expectations more explicit.

Attributable means that a record can be linked to the person or system that created or changed it. Contemporaneous means recording the activity when it occurs. Original includes the first capture and the metadata needed to understand it. Complete means retaining corrections, failed runs, and relevant audit trail entries, not just the accepted value.

This last point is often missed. Data integrity is not the same as data accuracy. A value may be scientifically correct but still lack integrity if its origin, timing, or changes cannot be reconstructed. Conversely, a properly documented error does not destroy integrity. It becomes part of the honest.

Problems can start before enrolment. A poorly designed case report form may allow ambiguous entries. Even where the CRA or a designated quality reviewer performs source data review, the monitoring plan should define which critical data will be reviewed, the timing and extent of the review, and how identified discrepancies will be escalated and resolved. A vendor may be selected for technical capability while its system validation and subcontractors receive less attention.

At the site, delayed transcription creates obvious risk. Duplicate or conflicting source records are another common problem. During an inpatient stay, the physician’s record and nursing notes may contain different entries for medication administration or the timing of laboratory sample collection. These records may serve different purposes, so a difference is not automatically an error. However, an unresolved inconsistency creates ambiguity and should be reconciled without overwriting original entry. Shared accounts, uncontrolled notes, incorrect time settings, and weak correction practices make reconstruction difficult. In decentralized trials, direct capture from apps, sensors, and home devices creates another issue. The sponsor must know what constitutes source data, what processing occurs inside the platform, and whether modified records remain visible.

Central laboratories, imaging providers, and biomarker partners generate data outside the main database. Mapping mistakes, unit conversions, duplicates, and subject identifier mismatches can enter during transfer. Reconciliation is therefore an essential control. It confirms that received data are complete and linked to the right participant and visit.

After database lock, records must remain readable and retrievable. If software is retired or a vendor closes, the sponsor still needs the data, metadata, audit trails and validation evidence required to understand the trial.

ICH E6 R3 places greater weight on proportional, risk-based quality management and reliable information throughout the trial. Its data governance provisions cover the complete data life cycle. It expects appropriate transfer and reconciliation processes so electronic data and relevant metadata retain integrity and confidentiality between computerized systems.

FDA guidance issued in October 2024 says electronic systems, records and signatures in clinical investigations should be trustworthy and reliable. It covers access controls, audit trails, validation, retention, digital health technologies and service providers. For regulated electronic records, 21 CFR (Code of Federal Regulations) Part 11 remains important, with the applicable underlying regulations.

The European Medicines Agency guideline says data governance should assign ownership across the life cycle, control changes, include training, and allow concerns to be raised. Technology does not carry the responsibility. The sponsor and investigator do.

Scope and limits of the law 

The BIOSECURE Act became law on December 18, 2025, through Section 851 of the US National Defense Authorization Act for Fiscal Year 2026. Its direct target is federal procurement and federal loan or grant funds. It restricts US executive agencies from obtaining biotechnology equipment or services from designated biotechnology companies of concern. It also reaches certain contractors using covered services in federal work.

The scope is wider than instruments alone. The law covers genetic sequencers and other equipment used to research, develop, produce or analyse biological materials. It also covers relevant software and digital components, as well as services involving biological analysis, data storage and transmission. Multiomic data are expressly defined to include genomics, epigenomics, transcriptomics, proteomics and metabolomics.

This does not mean that every private trial using an overseas CRO or laboratory is prohibited. That reading is wrong. Immediate legal exposure is tied to federal contracting, grants and loans. Practical relevance is wider. Sponsors may have mixed funding routes or future assets intended for government channels. A laboratory, sequencing platform, or subcontractor acceptable today may create restrictions or migration work later.

Implementation and transition risk

Implementation is staged. OMB must publish the initial list, followed by guidance and revision of the Federal Acquisition Regulation. As of early August 2026, OMB had not published the list. In June 2026, the Department of Defense added WuXi AppTec and Novogene to its Section 1260H list. This is not itself an immediate procurement ban, but it increases the possibility of future BIOSECURE coverage. Sponsors may have transition time, yet moving samples, data or validated workflows can still cause considerable disruption.

Map the complete data and vendor chain

Sponsors should begin with a complete data and vendor map. It should show where critical data originate, every system they enter, transfers, hosting locations, and each subcontractor with access. Include laboratories, sequencing providers, electronic outcome platforms, imaging vendors, safety databases, and statistical environments.

Vendor qualification should examine quality and security together. Review validation, role-based access, audit trails, incident response, backup testing, data residency, subcontractor controls and exit arrangements. For BIOSECURE readiness, identify equipment, embedded software and services that may fall within statutory definitions. Contracts need audit rights, incident notice, exportable records and transfer support.

Maintain oversight throughout the trial

Data governance matters more than a good qualification report. Indicators include late entry, unusual correction rates, disabled audit trails, unexplained exclusions and recurring transfer errors.

Corrective and Preventive Action (CAPA) should address the system cause, not merely retrain staff. Before database lock, review critical data flows and unresolved discrepancies. The trial master file should tell the same story as the clinical database.

Syngene brings clinical operations, biometrics, clinical data management, biostatistics, bioanalysis, pharmacovigilance, medical writing and regulatory support into a connected environment. Fewer disconnected handoffs can make ownership and reconciliation clearer, though integration is never a substitute for controls.

Digital systems used by Syngene for regulated clinical activities undergo a documented computerized system validation (CSV) process. This helps confirm that each system is fit for its intended purpose and meets applicable regulatory and data integrity requirements.

Syngene states that its quality system supports GLP, GMP and GCP activities and aligns with ICH guidelines, 21 CFR Part 11 and India’s New Drugs and Clinical Trials Rules, 2019, among other standards. Its biometrics and clinical data management teams support clinical data collection, reporting and analysis. Such oversight can help sponsors maintain traceability and inspection readiness.

For sponsors assessing BIOSECURE exposure, the useful capability is not simply geographic diversification. It is the ability to explain the data chain. That includes where samples are analyzed, how data move, which systems and vendors are involved, how access is controlled, and how records can be retrieved or transferred. A partner that can provide this evidence gives the sponsor something more durable than a compliance statement.

Data integrity must be maintained throughout the study, from initial data capture through processing, analysis, reporting and archiving. Gaps discovered near database lock or after study completion may be impossible to reconstruct, particularly when metadata or vendor records are missing. Ownership, traceability, system controls and vendor transparency therefore need to be built into the protocol and operating model from the beginning.

The BIOSECURE Act sharpens this requirement. It connects clinical data governance with national security, procurement eligibility and supply chain resilience. ALCOA plus remains the foundation. Yet sponsors now need to know more than whether data are complete and accurate. They also need to know who handled them, through what technology, under which controls, and whether that chain will remain acceptable for the future use of the evidence.

As clinical data ecosystems become more complex, sponsors need partners who can ensure traceability, governance, compliance, and data integrity across every stage of development. Syngene’ s integrated clinical development capabilities, spanning clinical operations, biometrics, data management, bioanalysis, pharmacovigilance, medical writing, and regulatory support, help partners build confidence in the quality, reliability, and future usability of their clinical data.

Learn more about Syngene’ s end-to-end clinical development and data management capabilities.

1. Biffa internal savings data, average saving (January - August 2023)
2. Nisbets internal savings data, average saving (January – September 2023)
3. Compliance365 internal data, average  savings
4. HEINEKEN UK data, Calculations based on SmartDispense® active accounts each year since 2015 with 10 lines
5. Independent test results based on subterranean and ground floor pub cellars of varying sizes
6. Independent test results based on subterranean and ground floor pub cellars of varying sizes