21 CFR Part 58 – Good Laboratory Practice (GLP)

This topic is part of the SG Systems Global regulatory & operations glossary.

Updated October 2025 • Nonclinical Study Conduct & Data Integrity • Laboratory, QA, Regulatory

21 CFR Part 58 sets the U.S. FDA’s Good Laboratory Practice (GLP) requirements for nonclinical laboratory studies that support research or marketing applications. GLP governs the organization, personnel, facilities, equipment, SOPs, test systems, test/control articles, protocols, quality assurance oversight, and—critically—the raw data, records, archives, and final reports used to demonstrate study integrity. In modern labs, GLP intersects with electronic controls such as 21 CFR Part 11, validated computerized systems (CSV), and governed documentation via Document Control. The regulation ensures that nonclinical safety data are scientifically reliable, reconstructable, and independent of operational bias.

“GLP is less about what you found and more about proving how you found it—cleanly, consistently, and under independent QA oversight.”

1) What Part 58 Covers—and What It Does Not

Covers: the conduct and documentation of nonclinical lab studies (e.g., toxicology, biocompatibility, residue, stability‑indicating method performance in support of safety) that will be submitted to FDA. It prescribes organization and personnel, QAU, facilities/equipment, test systems, test/control article handling, protocols and amendments, study conduct, records/reports, and archives.

Does not cover: clinical trials (GCP), routine commercial manufacturing (GMP), or exploratory discovery research. GLP also does not define product specifications or release criteria; those are addressed in GMP/QC frameworks and executed under MES/QC systems.

2) Legal, System & Data Integrity Anchors

GLP hinges on independence and traceability: an organizationally independent QAU that inspects studies and facilities; single‑point accountability via the Study Director; controlled SOPs and protocols in Document Control; validated computerized systems under CSV; electronic records and signatures compliant with Part 11 (and Annex 11 where relevant); role‑based access via UAM; and ALCOA(+) Data Integrity evidenced by immutable audit trails and durable archives.

3) The Evidence Pack for GLP Inspection

Expect to produce: org charts and QAU independence statements; a master schedule of studies; SOP index and versions; protocols, amendments, and deviations; training matrices and records; facility/equipment logs and calibration status; environmental and housekeeping records (e.g., EM where applicable); test/control article characterization, labeling, and storage records; LIMS/ELN raw data (including chromatograms for HPLC or spectra for UV‑Vis); QAU inspection reports and correspondence; the signed final report with QAU statement; and archive/retention registers.

4) From Protocol to Archive—A Standard Path

1) Study planning. Draft protocol under SOP; route for approval; register on the study master schedule.
2) QAU review. QAU reviews the protocol and plans in‑process and facility inspections.
3) Conduct & capture. Execute procedures per SOP and protocol; capture contemporaneous raw data in LIMS/ELN with audit trails; manage samples and test articles with barcoded chain‑of‑custody.
4) QA oversight. QAU performs protocol, critical‑phase, process, and facility inspections; communicates findings to management and the Study Director.
5) Reporting. Compile and sign the final report; include QAU statement on inspection coverage and findings.
6) Archival. Transfer raw data, reports, and specified materials to GLP archives with defined retention and retrieval controls.

5) Roles & Responsibilities

Management provides resources, independence for QAU, and enforces compliance. The Study Director is the single point of control for study conduct and raw‑data integrity. Principal Investigators (if used) manage phases at other sites under the Study Director. The QAU inspects, audits, and reports—never executes study work—to preserve independence.

6) Protocols, Amendments & SOP Control

Protocols define objectives, methods, acceptance criteria, statistics, and records. Amendments are controlled, signed, and justified; deviations are documented with impact assessment. SOPs govern recurring tasks (sampling, instrument use, data handling, archiving) under Document Control with training evidence via the Training Matrix.

7) Facilities, Equipment & Maintenance

GLP expects suitable, segregated spaces (e.g., test system rooms, sample receipt, archives) with environmental and housekeeping controls. Instruments and equipment require qualification/verification, calibration, maintenance, and logbooks. Utilities that can affect data quality (e.g., purified water, HVAC) should be fit‑for‑use and monitored (Utilities Qualification as applicable).

8) Test & Control Articles

Characterize identity, strength, purity, and stability; label and store under defined conditions; document receipt, use, and disposal; reconcile amounts consumed vs. dispensed. Tie claims to supplier CoA and confirm by Identity Testing where required.

9) Specimens, Samples & Raw Data

Assign unique IDs; capture timestamps, conditions, and handlers; link to the sampling plan (Sampling Plans); control hold times (Hold Time Study); and track location (e.g., freezer mapping). Retain primary raw signals (chromatograms, spectra, images) with audit trails and second‑person reviews where required.

10) Computerized Systems & E‑Records

Systems that create, process, or store GLP data must be validated proportional to risk (CSV), governed by UAM, and protected by tamper‑evident audit trails. Electronic signatures and submissions must meet Part 11. Control spreadsheets and custom scripts under Document Control or replace with validated LIMS/ELN functions.

11) QAU Program & Inspections

The QAU maintains the master schedule; inspects studies (protocol, critical phases, raw data), facilities, and processes; audits the final report against raw data; and issues written reports to management and the Study Director. The signed QAU statement in the final report documents what was inspected and any significant findings and their status at the time of reporting.

12) Deviations, Data Issues & Remediation

Departures from protocol/SOP are recorded with impact assessment, corrective actions, and approvals. Investigate data anomalies under Deviation/NC and, where your quality system applies, close with CAPA. Trend deviations and QAU observations to prevent recurrence and to strengthen SOPs, training, and methods.

13) Metrics That Demonstrate GLP Control

• QAU on‑time inspection rate and finding closure time.
• Training currency for GLP roles vs. the Training Matrix.
• Instrument calibration compliance and data review timeliness.
• Protocol amendment cycle time and deviation rate per study phase.
• Archive retrieval SLA and data integrity event rate (audit‑trail exceptions, access violations).

These KPIs evidence a living GLP program with independent oversight, capable methods, and durable records.

14) Common Pitfalls & How to Avoid Them

• QAU conflicts of interest. Keep QAU independent from study execution.
• Uncontrolled protocol/SOP versions. Use Document Control and effective‑dating.
• Raw data gaps or re‑transcription. Capture primary signals electronically with audit trails; avoid offline spreadsheets.
• Shared logins. Enforce named accounts via UAM.
• Unvalidated calculations. Validate LIMS/ELN methods under CSV; govern scripts.
• Weak archiving. Define retention, ensure retrieval testing, and monitor environmental conditions for archives (Record Retention).

15) What Belongs in the GLP Study Record

Study identifiers; protocol and amendments; SOP list; training records; facility/equipment logs; test/control article records; sampling plans; raw data and instrument originals; calculations and data reviews; QAU inspection reports; final report with signed QAU statement; correspondence; archive transfer and index; and the retention schedule in force. All items must be attributable, contemporaneous, and reconstructable.

16) How This Fits with V5 by SG Systems Global

Protocol, SOP & training governance. The V5 platform controls protocols and SOPs under Document Control, links effective versions to execution, and verifies user competency through the Training Matrix before study tasks can be performed.

Execution with raw‑data capture. V5 integrates lab instruments (e.g., HPLC, UV‑Vis) so primary files land in LIMS/ELN with immutable audit trails, eliminating spreadsheet drift and re‑typing risk.

QAU workspace & master schedule. A dedicated QAU view tracks the study master schedule, inspection plans, critical‑phase holds, and finding closure; signed QAU statements are generated from the same evidence set used by the Study Director.

Electronic compliance controls. Role‑based UAM, Part 11 e‑signatures, and validated workflows (CSV) provide end‑to‑end attribution. Interfaces to Archival manage retention, legal holds, and retrieval tests.

Bottom line: V5 turns GLP compliance into a click‑through narrative—from protocol to QAU statement to archive—so nonclinical data are defensible, discoverable, and inspection‑ready.

17) FAQ

Q1. How is GLP different from GMP and GCP?
GLP governs nonclinical lab studies and their data integrity; GMP covers commercial manufacturing and release; GCP covers clinical trials in humans.

Q2. Do electronic records have to meet Part 11?
Yes—if you create, modify, maintain, or sign GLP data electronically, Part 11 controls (e‑signatures, audit trails, security) apply alongside GLP.

Q3. Can I use spreadsheets in GLP?
Only under control: validated for intended use, versioned, locked, and audit‑trailed. Prefer validated LIMS/ELN functionality to reduce risk.

Q4. What must QAU include in the final report?
A signed statement describing the inspections performed (study phases, dates, facilities) and noting significant findings and their status at reporting.

Q5. How long must GLP records be kept?
Retain per Part 58 requirements and sponsor policy—typically years beyond study completion or regulatory decision—under governed archives with tested retrieval.

Q6. Can sponsors outsource GLP studies?
Yes, but the sponsor retains responsibility for ensuring the CRO operates under GLP; define expectations in quality agreements and verify via QAU oversight.

Related Reading
• Core Controls: Document Control | Data Integrity | Audit Trail | UAM | 21 CFR Part 11
• Lab Execution: LIMS | ELN | HPLC | UV‑Vis
• Methods & Sampling: Test Method Validation (TMV) | Sampling Plans | Identity Testing
• Records & Oversight: Record Retention | Deviation/NC | CAPA | Environmental Monitoring