ISO/IEC 17025 clause 7.11: protect laboratory data and information
Clause 7.11 requires access to the information needed for laboratory activities and effective control of the systems that collect, process, record, report, store or retrieve it. The term includes computerised and non-computerised arrangements. Purchasing a laboratory information management system does not establish conformity by itself.
What clause 7.11 requires in practice
Clause 7.11 covers the data and information the laboratory depends on, in computerised and paper-based form alike. It has six strands. The laboratory has access to the data and information it needs for its work. Systems used to collect, process, record, report, store or retrieve data are validated before introduction, and later changes are authorised, documented and validated before use. Those systems are protected from unauthorised access, guarded against tampering and loss, run in a suitable environment, maintained so data stays intact, and record failures with immediate and corrective actions.
If an outside provider or an off-site arrangement runs the system, the laboratory ensures the operator meets the applicable requirements. Instructions, manuals and reference data are readily available to staff, and calculations and data transfers are checked in an appropriate and systematic way.
The standard notes that widely used commercial software working within its designed range can be treated as sufficiently validated.
Validate functionality and control changes
Clause 7.11.2 requires laboratory validation of relevant functionality, including interfaces, before introduction. Changes, including configuration and modifications to commercial software, must be authorised, documented and validated before implementation. The standard recognises that generally used off-the-shelf software within its designed application range can be considered sufficiently validated, but that does not automatically validate custom formulas or interfaces.
Use the focused software guide for the release decision. The wider clause also requires the laboratory to maintain suitable day-to-day protection and reliable use of its information arrangements.
Protect access, integrity and availability
Clause 7.11.3 addresses unauthorised access, tampering, loss, suitable operating conditions and maintenance of data integrity. For manual systems, conditions must safeguard accurate recording and transcription. Record system failures and appropriate immediate and corrective actions.
Choose controls appropriate to the system and information. Permissions, backups and recovery checks may be important in electronic arrangements; secure storage, legibility and controlled transcription matter for paper records. These examples are not a universal product specification. The laboratory must demonstrate effective protection for its actual workflow.
Retain responsibility for externally managed systems
Where a system is maintained off-site or by an external provider, ensure that the operator meets the applicable requirements of ISO/IEC 17025. Evaluate the service, responsibilities and evidence rather than assuming a provider's marketing claims cover laboratory needs.
Make relevant instructions, manuals and reference data readily available to personnel. Users need to understand correct operation and what to do when something fails. A technically sound system can still produce unreliable results when staff use an obsolete configuration or an undocumented workaround.
Check calculations and transfers systematically
Clause 7.11.6 requires appropriate systematic checking of calculations and data transfers. Identify where values, units, identities or interpretations can change as information moves between instruments, spreadsheets and reports. The check should address the actual risk, including automated interfaces.
Why data and information control matters to the business
Almost every laboratory result passes through a spreadsheet, an instrument export or a database before it reaches a customer. A silent fault in any of them can corrupt many reports at once, and the laboratory may not notice until a customer does.
Sound control of data protects the credibility of every result and limits the scale of any failure. It also matters for confidentiality, because customers send sensitive samples and information. Buying a system does not settle the point: assessors and customers want to see how the laboratory knows its own configuration works, who can change it and what happens when it breaks.
How to implement clause 7.11
Begin with a plain map of where laboratory data lives, including the informal places, then work out the controls proportionately. A proportionate approach matters. A laboratory with a few spreadsheets and a paper logbook needs different controls from a multi-site information system, but the same questions apply to both, and the answers must be evident.
- List every system, spreadsheet, instrument export and paper form that holds laboratory data, and name an owner for each.
- Decide the level of validation each deserves, based on how directly it affects reported results.
- Set access rights by role, and review who still holds access when people change jobs.
- Arrange protection against loss and tampering, such as backups with an occasional restore check for electronic data and secure storage for paper.
- Review contracts with external system providers to confirm responsibilities and the evidence they can give.
- Make manuals and reference data easy to reach, and define how calculations and transfers are checked and how system failures are logged.
Two illustrative data controls
A calibration laboratory transfers instrument data into a reporting system. It checks mapping, units, rounding and item identity through the interface rather than testing only whether a file imports successfully. A technically correct measurement can become an incorrect report through a transfer error.
A testing laboratory uses paper worksheets followed by administrative data entry. It establishes legible recording, controlled transfer and appropriate checks, with responsibilities clear for the supporting team. Paper-based work is not exempt from information integrity requirements simply because there is no LIMS.
Evidence and common weaknesses
Relevant evidence includes validation and change records, protection arrangements, system failures and responses, provider controls, available instructions and systematic checks. Coordinate these with technical-record and retention requirements. Avoid shared accounts that obscure changes, untested recovery assumptions, unsupported software workarounds and uncontrolled spreadsheets outside the main system.
Explore each numbered part
7.11.2 · validate laboratory systems and changes
Demonstrate that laboratory information systems perform their intended functions before introduction and after relevant changes. This guide covers interfaces, configuration, commercial software and laboratory-specific calculations, with examples explaining how to use supplier evidence appropriately without assuming that installation success proves reliable processing and reporting of your own laboratory data.
Frequently asked questions
Does clause 7.11 apply to paper-based laboratories?
Yes. The standard includes non-computerised information systems, although some requirements are more relevant to electronic systems. Accurate recording, protection and reliable transfer still matter.
Does using a cloud provider transfer responsibility away from the laboratory?
No. The laboratory must ensure the external operator meets applicable requirements for the system. Provider arrangements need to support the laboratory's actual technical obligations.
Must automated data transfers be checked?
Yes. Calculations and transfers require appropriate systematic checks. Automation can reduce some errors while introducing others through configuration, mapping, units or software changes.
Turn this requirement into reliable laboratory practice
Sterling can help map the data journey behind one laboratory result, including external systems and manual handovers. Bring your workflow to a free consultation to identify practical implementation and training priorities.
Build the team's understanding through Documented Information Management. Discuss the relevant scope, employee learning and agreed access to Effivity ISO & GRC automation software with Sterling; laboratory technical decisions remain with competent, authorised personnel.
ISO/IEC 17025 requirements hub · Process requirements · Validate systems and changes · Technical records · Record retention