Does 21 CFR Part 11 or GxP apply to our commercial pharma data?

Mostly no. 21 CFR Part 11 covers electronic records that an FDA regulation requires you to keep, plus records you submit to FDA. Syndicated sales, specialty pharmacy status, and incentive comp data are not required records. The exceptions are drug sample records under 21 CFR 203 and adverse event reports that arrive through commercial channels.

Chris Bergh Published October 20, 2026

Key points

21 CFR 11.1(b) applies Part 11 to electronic records kept under records requirements in FDA regulations, and to electronic records submitted to FDA. A record no FDA rule requires is outside it.
FDA's September 2003 Part 11 scope and application guidance says records not required to be retained under predicate rules are not Part 11 records, even when you keep them electronically.
Drug sample request and receipt records under the Prescription Drug Marketing Act are the clearest commercial exception: 21 CFR 203.60 allows electronic versions only if Part 11 is met, and requires keeping them at least 3 years.
Adverse drug experience information from commercial marketing experience must be reviewed under 21 CFR 314.80, and the applicant keeps those records for 10 years, so a safety signal in a CRM note or a hub file is a regulated record.
Running sales reporting under clinical-grade validation is a cost choice, not a requirement. At one rare-disease biotech, in a DataKitchen case published August 2026, a large share of the old commercial data bill came from running analytics as regulated data, and the annual cost of running that data fell about 58%.

This is not legal advice. It’s a reading of the regulation and FDA’s own guidance on it, as published in October 2026. Your quality and regulatory teams make the call for your systems.

Here’s why the question matters. At one rare-disease biotech, a large share of the old data bill existed because everything ran as regulated data. Change control, documentation, and qualification overhead on every change to a weekly commercial dashboard. That’s the right price for clinical data. It’s the wrong price for sales reporting nobody at FDA will ever ask to see.

What Part 11 actually covers

The scope is one sentence. 21 CFR 11.1(b) says Part 11 “applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations.” It also covers electronic records submitted to FDA.

The trigger is a records requirement in an FDA regulation. FDA calls those predicate rules. Its 2003 scope and application guidance says Part 11 “will be interpreted narrowly,” and that records “not required to be retained under predicate rules, but that are nonetheless maintained in electronic format, are not part 11 records.”

GxP is the umbrella for the good practice predicate rules, such as Part 58 for nonclinical labs and Part 211 for manufacturing. None of them governs a weekly TRx report.

Where commercial data sits

Commercial data	FDA records requirement?	Part 11 applies?
Syndicated sales and prescriptions (IQVIA, Symphony)	None found	No, by default
Specialty pharmacy dispense and status files	None found	No, by default
Territory alignment and incentive comp inputs	None found	No
CRM call activity	None for the activity itself	No, unless it carries an adverse event
Drug sample requests and receipts	Yes, 21 CFR 203.60, kept 3 years	Yes, if electronic
Adverse drug experiences from commercial channels	Yes, 21 CFR 314.80, kept 10 years	Yes, if electronic
Open Payments submissions	CMS rule (42 CFR 403), not FDA	No, but the reporting company attests to accuracy

The table reads the regulations cited. It is a starting checklist for your regulatory team, not a determination.

The two exceptions that live in commercial systems

Drug samples. The Prescription Drug Marketing Act rules let you keep sample request and receipt records electronically “provided the requirements of part 11 of this chapter are met.” Records go back at least 3 years. A paper form scanned into a computer becomes an electronic record that must meet Part 11 too. If your sample management feed lands in the commercial warehouse, the copy of record still needs to be the controlled one.

Adverse events. 314.80(b) requires prompt review of adverse drug experience information “from any source,” and it names “commercial marketing experience” explicitly. Field reps, hub services, and specialty pharmacy patient status notes are commercial sources. A safety signal in any of them belongs in the pharmacovigilance system, which keeps it 10 years. Your commercial data platform’s job is to route it there and not be its only home.

What to control instead

Outside those two, you still want an audit trail. It just isn’t Part 11’s. Due diligence asks whether the commercial story is accurate, auditable, and defensible. Leadership asks whether last quarter’s number changed. A reconciliation record on every feed answers both, and the commercial pharma FAQ covers how that held up through three acquisitions.

So separate the systems. Put sample and safety records under validation. Run everything else on tested pipelines with version control and a record of each test result, the setup described on the commercial data platform page. Those tests catch the partial files and restatements that actually break commercial reporting, which validation paperwork never did.

Open Payments sits apart again. It’s a CMS program, and the company’s attestation is the control: 42 CFR 403.908(e) requires an officer to attest that the report is timely, accurate, and complete. That’s why testing the file against the reporting rules before you submit pays for itself. See how to validate Open Payments data before you submit.

Validation overhead on a dashboard makes every change slower and no number more accurate.

Follow-up questions

Frequently asked questions

Is a commercial data warehouse a GxP system?

Usually not. GxP is shorthand for FDA's good practice rules, such as good laboratory practice in 21 CFR Part 58 and good manufacturing practice in Part 211. A warehouse holding syndicated sales, specialty pharmacy status, and territory data supports none of those regulated activities. It becomes regulated when it holds a record an FDA rule requires, such as drug sample records or adverse event information.

Does Part 11 apply to IQVIA, Symphony, or specialty pharmacy data?

Not by default. 21 CFR 11.1(b) applies Part 11 to electronic records kept under FDA records requirements and to records submitted to FDA. FDA's 2003 scope guidance says records not required under predicate rules are not Part 11 records, even when kept electronically. Purchased sales data is a business record. Check whether any field in it, such as a patient event, feeds a required record.

Are drug sample records subject to Part 11?

Yes, when you keep them electronically. Under the Prescription Drug Marketing Act rules, 21 CFR 203.60(a) lets manufacturers use electronic records and signatures for sample requests and receipts only if the requirements of Part 11 are met. 21 CFR 203.60(d) requires keeping sample distribution records for at least 3 years. A sample management feed is regulated even when the rest of commercial data is not.

What if a sales rep or hub hears about an adverse event?

That information is regulated. 21 CFR 314.80(b) requires the applicant to promptly review adverse drug experience information from any source, including commercial marketing experience. 314.80(j) requires keeping those records, with raw data and correspondence, for 10 years. A CRM call note or patient services record that carries a safety signal belongs in the pharmacovigilance process, not only in a commercial dashboard.

Does Open Payments data fall under Part 11?

No. Part 11 is an FDA rule for FDA records requirements, and Open Payments is a CMS program under 42 CFR 403. Its control is the attestation: CMS requires the reporting company to attest to the timeliness, accuracy, and completeness of the submitted data, and reporting is complete only when that attestation is received. That makes validation before submission worth doing on its own terms.

Is this legal advice?

No. This summarizes 21 CFR 11.1, FDA's 2003 Part 11 scope guidance, 21 CFR 203.60, and 21 CFR 314.80 as published on eCFR and fda.gov in October 2026. Your quality and regulatory teams decide which of your systems hold predicate-rule records. DataKitchen engineers commercial data platforms and does not provide regulatory or legal opinions.

Talk to the team that tests this data every week.

Half an hour on your stack, your launch window, and what the first sprint would look like.

Find out more