Xendo - Office

Who we are

Xendo, a ProPharma Group company, is a leading consultancy and project management organisation in the fields of (bio)pharmaceutical products, medical devices, and healthcare. Thanks to our multi-disciplinary, knowledge-driven approach, we deliver a broad palette of services to the life sciences industry, applying the right colour to projects we participate in. For over 25 years, we have successfully completed thousands of national and international assignments for start-ups as well as for the largest, established multinational companies and organisations. ProPharma Group combined with Xendo has more than 1,000 professionals worldwide providing an unmatched variety of compliance related services including medical information, pharmacovigilance, clinical safety, regulatory affairs, and a continuously expanding range of compliance, quality assurance, validation, and consulting services; providing a full-colour spectrum.

Our clients

The spectrum of our fields of expertise is as broad as the range of clients we work for, enabling us to cater to the varied needs and wishes of the Life Science industry. By creating an integrated solution, ProPharma Group is your single-source, global independent provider of compliance, regulatory affairs, pharmacovigilance, and medical information solutions providing the insights and services needed to maintain the highest level of value and patient safety. We bring our palette of services to companies, ranging from start-ups to multi-national organizations, to provide them with robust solutions. Whether they are a (bio)pharmaceutical or medical device company, a hospital or a pharmacy, a manufacturer or a laboratory, we match their colour.

Read more

#Orphan Drugs: Product Similarity & Market Exclusivity

The effects of the EU orphan legislation are substantial: over 1,950 orphan designations have been issued by the European Commission since the year 2000, of which 142 have resulted in authorised medicinal products so far (EMA Annual report 2017). The EU orphan incentives stimulate the development of medicinal products to make sure patients suffering from rare diseases have access to the same quality of treatment as other patients. For many start-ups and small pharmaceutical companies, developing a drug without the benefits of the orphan incentives is unthinkable and the orphan drug designation (ODD) is an absolute condition for investments.  

However, with more and more drugs getting approved while maintaining the designated orphan status, developers of drugs within the same orphan drug condition see themselves faced with a higher raised bar. Questions like “what are the options for a product to enter the market in case of an already approved drug for the same therapeutic indication” are frequently asked? The situation is complex as two different set of criteria of the orphan drug regulation apply, each with its own conditions and consequences:

  1. Market exclusivity of the competitor
  2. Maintaining the orphan drug designation status by showing significant benefit.

The criteria and options for entering the market in case of another orphan drug approved for the same therapeutic indication with market exclusivity period are summarized in the scheme below:

MA: Marketing Authorisation; ODD: Orphan Drug Designation

*Similar being defined as an identical active substance, or an active substance with the same principal molecular structural features (but not necessarily all of the same molecular structural features) and which acts via the same mechanism (EC 847/2000 Art 3.3(c), amended by EC 2018/781).

**Clinical superiority being defined as a medicinal product is shown to provide a significant therapeutic or diagnostic advantage over and above that provided by an authorised orphan medicinal product (EC 847/2000, Art 3.3(d)).

***Significant benefit means a clinically relevant advantage or a major contribution to patient care (EC 847/2000, Art 3.2)



The first criterium in getting your product registered relates to the presence of a 10-year market exclusivity for another designated orphan drug being granted a marketing authorisation. I.e. another similar medicinal product can in principle not be placed on the market in the EU for the same therapeutic indication (Art 8(1) EC 141/2000). In this concept, a similar medicinal product is defined as an identical active substance, or an active substance with the same principal molecular structural features (but not necessarily all of the same molecular structural features) and which acts via the same mechanism (for detailed explanation, refer to EC 847/2000 Art 3.3(c), C(2008)4077, and EC 2018/781). The market exclusivity period can be extended by two additional years when the results of studies in the paediatric population are presented in accordance with a Paediatric Investigation Plan. The market exclusivity incentive prevents other companies to easily place a generic product on the market, irrespective of the legal basis of the original application and of the patent situation.

Marketing authorisation for similar products

If the active substance is indeed similar, your product can only be placed on the market for the same therapeutic indication when

  1. consent of the original marketing authorisation holder is obtained,
  2. the original marketing authorisation holder is unable to supply sufficient quantities or
  3. the medicinal product is safer, more effective or otherwise clinically superior despite having a similar active substance (for a detailed explanation see: C(2008)4077).

In these cases, marketing authorisation will be granted and the product can be launched but without the orphan drug status and the rights of market exclusivity.

If the situation and clinical program of your similar product allow, the planned indication might be adjusted to target a patient group not protected by the market exclusivity. Alternative indications might already be explored during the development of your product in case of the expected competition of a similar product. The adapted indication can but might not necessarily have an orphan drug status.

Marketing authorisation for non-similar products

If your product contains a non-similar active substance while the intended indication is similar, marketing authorisation can be granted by the EMA or national authorities without further provisions or restrictions related to marketing exclusivity of the registered competitive product. The usual positive benefit/risk requirement for your product applies for a marketing authorisation without ODD status and without benefits from incentives related to ODD status. In case the marketing authorisation of your product is granted via a full or full-mixed application, i.e. based on own clinical studies, the usual data exclusivity (8 years) and market protection periods for this type of application apply, protecting you from generic products for the same indication entering the market. Also, the patent protection period applies as usual.


In case ODD status is wished additional to the marketing authorisation, for either the protection period of market exclusivity or to increase market value, the second criterium of significant benefit has to be complied with. To maintain ODD status after marketing authorisation of your product, clinically relevant advantage or major contribution to patient care, compared to all authorised orphan drug product and other products and treatments for that orphan condition needs to be demonstrated.

This concept of significant benefit can be based on improved efficacy, improved safety or a major contribution to patient care and there has to be a high probability for patients to actually experience this benefit when using your product. At the time of marketing authorisation application, the demonstration has to be based on clinical comparison data. Depending on the situation either a direct or an indirect comparison between your product and the competitive product(s) can be made. Likewise, comparison with other treatments which the patients diagnosed with the orphan disease may receive needs to be provided. If benefits to patients are expected to be similar or if the investments to gather comparison data via clinical studies will be too high or time-consuming, your product can still obtain a marketing authorisation without the ODD status as explained above in this blog.

The concept and requirements for the significant benefit are further explained in Recommendations from the Committee for Orphan Medicinal Products (EMA/COMP/15893/2009), Guideline on the format and content of applications for designation as orphan medicinal products (ENTR/6283/00) and Commission notice 2016/C 424/03.


The approval of a competitor orphan drug product with rights of market exclusivity in the target indication of your product will raise the bar, but options still remain to register and market your product. If not similar in active substance, market authorisation with and without maintaining ODD status is possible. If you have an EU orphan drug status for your product, this is what you can do:

  • Continuously follow-up on programs of competitor products, similar or non-similar, in the orphan drug condition not to be surprised by granting of approval of another orphan drug in your target indication.
  • Even though competitor products have not been granted marketing authorisation, evaluate similarity and significant benefit criteria explained in this blog and the pros and cons for each option.
  • Anticipate if you need to prepare for alternative routes in your development program.
  • In case extra investments in the clinical program are needed to maintain the ODD status at the time of marketing authorisation, assess whether the investments balance the expected profits on the market.



Blog by: Patricia Baede, Liesbeth Hof

Read more

#6 Ways to increase the value of your ATMP development

As the field of modern medicine is changing, so should the development strategies of new medicines, including advanced therapy medicinal products (ATMPs). Many ATMPs are being developed for rare/orphan diseases with an unmet medical need. The inherent complexity of ATMPs poses several challenges to the translation of these products to the clinic, like not being able to follow standardized CMC, non-clinical and clinical development strategies. Instead, comprehensive and product-specific development programs may be required prior to marketing approval. Altogether, a bumpy road to market authorization lies ahead.

In general, in the translation of an ATMP from research to market authorization, it’s worthwhile to pay careful attention to the following aspects:

  1. Business strategy and investors
  2. Product Definition
  3. Chemistry, Manufacturing, and Controls (CMC)
  4. Nonclinical development
  5. Clinical development
  6. Regulatory strategy

In this blog, we will briefly touch upon these areas.

1: Business strategy and investors

Building a solid business case early is a strong prerequisite for being successful in partnering with investors and co-developers. And as such it is likely to be considered a solid proposition for investment if you’re planning both for development of your product into clinical stages as well as market approval in the end.

You need to address essentials like:

  • Company organization
  • Partnerships & collaborations
  • Roles and responsibilities of the management team and board
  • IP and freedom to operate
  • Competitor analysis

In this way, you cover a major investment requirement to position your ATMP development from a broader perspective and to provide a clear market assessment of your ATMP.

2: Product definition

A target product profile (TPP) is an important tool to facilitate the interactions with health agencies to align your development with regulatory expectations. In addition, the TPP is also a valuable instrument to facilitate both internal and external communication and can be translated into a Quality TPP (QTPP). Both are dynamic documents that facilitate the integration of all development disciplines into a predefined and suitable process.

3: CMC development

ATMPs are usually manufactured using complex biological and technological processes for which many protocols are to be developed. . Various cell lines, tissues, or vectors are needed as starting materials and multiple steps are required to select, modify and expand cells and/or produce your vector. Culturing, modification, harvesting, purification and formulation of the product all give rise to challenges regarding product quality characteristics like purity, potency, and safety. Furthermore, manufacturing processes often demonstrate an inherent variability causing significant heterogeneity between batches, which also relates to the challenges in testing, characterization and control.

Some things to keep in mind:

  • Changes to an ATMP design to obtain improved product characteristics pose a challenge to the evaluation of the impact on the safety and efficacy profile of the product. It is beneficial to design a solid TPP and a project development plan that properly defines the required product and process characteristics. In conjunction, major milestones and related criteria for the anticipated go-no-go reviews should be defined beforehand. Such a work plan may help to reduce a need for later bridging studies or guide the design of these bridging studies in case they would be required to link early to mid and late-stage development.
  • To create more value you can investigate how to expand your development platform or processes to other indications or products. For example, a change in transgene could possibly treat a different indication with the same vector backbone and promoter.
  • To save time and resources, it is important to perform a solid process development to minimize the gap between non-GMP and GMP manufacturing.
  • Also, the tech-transfer between these should start in an early phase to assure alignment of the development and manufacturing of the ATMP.

Overall, it’s crucial to engage early with regulatory agencies to align your pharmaceutical development, your manufacturing strategy and your comparability plans and discuss the impact on the performed and planned non-clinical and clinical development activities.  This not only speeds up the marketing process but also builds confidence in your company and current product for potential investors.

4: Non-Clinical development

Prior to the clinical administration of an ATMP, adequate non-clinical information should be provided using a relevant animal model. Due to the specific characteristics of ATMPs and differences in regulatory requirements, non-clinical development may not follow a “standardized” approach. Products used in non-clinical studies should be representative of the product that will be administered to humans in clinical studies.  In addition, the animal models used should have a predictive value to the clinical use of the product in humans bearing the disease indication in mind.

The final product should be based on the right data. This might sound like a no-brainer, but in reality, products are being developed that aren’t. For instance, during development imposed differences in isolation of cell sources, other vector backbone or differences in matrix preparation can induce a huge discrepancy in outcome parameters and present the risk of not being able to connect your non-clinical development to a product that can be used in clinical trials.

Non-clinical studies should be performed using the most relevant in vitro and in vivo models available, the rationale for the selection of these models needs a solid justification. The animal model needs to be suited to allow for translation to the clinical use of the product. In case a single animal model isn’t sufficient to bridge non-clinical study outcomes to a clinical prediction, various different animal models may need to be employed. Very important notice on this is that early interaction with regulatory authorities has proven beneficial in convincing on the justification of the proposed animal models.

Dosing is always a difficult issue. As ATMPs are being developed in animal models that for example are different in size, metabolism, immunological status compared to humans, the administered dose cannot be translated on a one to one basis for human use. The best you can do is to make an educated estimate on the dose and stay on the safe side. Also, take into consideration the method of administration, as different routes of administration can have different tolerability and efficacy outcomes.

In gene therapies, the risk of viral spreading into the environment should be addressed in non-clinical studies. Non-clinical studies are required to estimate the potential shedding of the viral vector. A challenge in the design of meaningful shedding studies relates to the fact that many viral vectors used in gene therapies do not infect and rarely replicate in nonhuman species. One way to address this is to take advantage of the fact that many vector types have been used clinically with different indications and publically available shedding data may be applied in the environmental risk assessment.

5: Clinical development

Many ATMPs are first in man clinical trials and/or first in class medicinal products. Consequently, the clinical trial design harbours specific challenges like:

  • The mode of delivery that should be described in an extensive TPP at an early stage of development
  • Setting your inclusion and exclusion criteria right
  • Selection of a starting dose and a staggered approach for patient enrolment

These clinical trial design aspects are important considerations as the safety profile of ATMPs can be evaluated only limitedly in non-clinical studies. In some cases, an estimated risk can be accepted when the potential clinical benefit outweighs the potential risk within a specific population. Clinical study design should be able to detect clinically meaningful endpoints but surrogate endpoints can be accepted for example in the context of rare disease indications.

Potential safety issues may relate to inflammatory responses, immunogenicity, disturbed gene control and off-target effects and there is a potential risk of transmission to third parties. Also, for gene therapies, other concerns relate to the persistence of viral vectors and genomic integration into the host's genome. For cell therapies and tissue-engineered products, specific risks may relate to graft failure, oncogenicity and unwanted immune responses.

Given the unique character of ATMPs specific requirements for long-term follow up are demanded. The design of the long-term follow-up regimen needs to be determined on a case-by-case basis depending on the product and the trial population.  

6: Regulatory strategy

A scattered regulatory landscape poses inherent challenges for the development of a globally acceptable development strategy. In many cases, not only the large agencies as EMA and FDA are involved but also different national agencies. So, transitioning from preclinical development to market authorization requires a carefully considered regulatory strategy and close collaboration with Health Authorities (global and local) to support the development of your ATMP.

It’s advised to apply a risk-based development approach as described by EMA in their risk-based approach guideline to ATMPs.

As indicated by EMA in this guideline: “The risk-based approach is based on the identification of various risks associated with the clinical use of an ATMP and risk factors inherent to the ATMP with respect to quality, safety and efficacy”. This statement in itself suggests that the design of an integrated development strategy would require a multidisciplinary integration of CMC, non-clinical and clinical development and should be strongly connected to a regulatory strategy that accounts for the product as well as the regulatory challenges.

A solid regulatory strategy will not only expose any regulatory challenges but also create regulatory opportunities. It will allow you to:

  • Set milestones and deliverables
  • Identify risks and mitigation strategies
  • Set up a strategy for communication with Health Authorities

This will all be beneficial in guiding your ATMP through the regulatory maze and make sure opportunities turn into reality.


To date, only a few ATMPs obtained marketing authorization and most academia and startups are usually more focused on the science and technology than the actual development of these innovative and often complex products. Wrapping up, we stress the importance of creating a development plan that identifies all the interdependencies between non-clinical, CMC and clinical development early on.

Although each ATMP is unique and needs a tailored development and regulatory strategy, critical steps can actually be identified and anticipated on beforehand and a tailor-made regulatory strategy can provide you with the guidance and focus required for successful development. Especially in the early stage of development, engagement with regulatory agencies supports to align development milestones and assure regulatory compliance in the end.

When you realize that all the different aspects of ATMP development are intertwined and changing one might have a huge impact on another, you are on the right track. So get ready to save time and get your development plan and regulatory strategy straight!

Blog by: Harm Hermsen & Merel Stok





Read more


The daily business of regulatory professionals involves processing of complex information from inside business and authorities. Today’s validated IT solutions are usually not flexible enough to keep pace with the ever-changing regulatory environment and the need for on-the-spot information. We build RA intelligence tools based on our day-to-day work experience. Our RA consultants translate specific tasks e.g. variation classification into flexible and versatile solutions like the mobile App RegChange.

In this tool, the EU classification guideline is broken down into the individual changes, greatly simplifying navigation through the document. Conditions, notes and documentation requirements directly connected to the selected change and Article 5 changes are included.

Note: RegChange has been made publicly available by the BPI (German Pharmaceutical Association) and is used by over one hundred professionals daily. 

Try RegChange!

Read more

#Biotech-BBQ – What's hot?

Date: 26.09.2018 | 8:00 - 16:15
Venue: Strelitzer Straße 60, 10115 Berlin at CQ Beratung + Bildung
Organizer: bbb Biotechverbund Berlin-Brandenburg Akademie UG (haftungsbeschränkt)
Costs/fee: Regular - 90,- € | Early-Bird - 75,- € if you register by July 31st 2018

It is an exciting time for companies developing new and complex biopharmaceuticals. As we gain more experience in the application of highly advanced technologies, as well as in new production processes for biopharmaceuticals, the regulatory landscape and recent strategies for the development of these products are rapidly evolving. It is not an easy task to keep track of best development practices and regulatory requirements.

This interactive workshop will support you in your efforts to better understand these relevant topics based on the vast experience of our speakers who will present case studies in their respective fields. As a highlight of this workshop, a panel discussion will take place to address and discuss questions and issues that you are facing in your daily business.

Outcomes of this workshop: gaining insights into improving your product development regarding timelines, costs and risk management.

Who should attend: Professionals and Managers in regulatory and development functions and Financial Investors.

Presentations will be in English, the detailed agenda can be found here.

Our presenters are recommending 3 blogs for pre-reading:


Register now!

Read more

#Medical Device Regulation: 4 Steps to prepare your clinical evidence

It’s been looming for a while now: the new MDR. There’s been a lot of talk about how it will affect companies in different ways. For instance, we wrote this blog on “why it’s a good plan to start preparing because otherwise, it’ll probably cost you money in the end”. From this point onwards, we will be sharing blogs on specific topics to help you prepare.

In this one, we will provide you with some strategies to prepare for the increased need for clinical data & evidence to CE mark your device. So let’s get started:

Initiation of the increased requirements for clinical evidence was actually already initiated with the last revisions of the MEDDEV guidance documents with the MDD still being in place. The further increase in the number of articles referring to clinical evidence in the MDR illustrates this huge increase of focus:

  • the MDD mentions clinical investigations in 1 article
  • the MDR has 12 articles on pre CE marking activities and 10 on post-CE-marking activities regarding clinical evidence.

Medical Device Regulation (MDR)

Medical Device Directive (MDD)





And associated annexes XIV, XV

Article 15 with reference to Annex X: clinical evaluation requirements


The increase in requirements for clinical evidence is also visible in the behavior of the Notified bodies. When manufacturers currently submit their technical files for obtaining the CE mark, they already experience that the need for more robust clinical evidence is requested. More importantly, manufacturers also experience the increased need for clinical evidence during re-certification of their device. Examples are already available about manufacturers that aren’t granted prolongation of the CE mark on their device with the result that it has to be withdrawn from the market. These examples are not limited to small start-up companies or to high-risk class devices: there are also established companies that were faced with no prolongation of certification until they were able to provide the necessary clinical evidence. Moreover, there are examples of low-risk class devices that lost their CE mark too.

It can even be that manufacturers with low-risk devices are more at risk regarding the extension of the CE mark because the gap been new requirements and the available clinical evidence might be bigger than for high-risk, class III, devices.


All currently certified Medical Devices must be re-certified in accordance with these new requirements. Because certification might be for a period of 3 years, the result is that a device that is CE marked just before May 2020 under the MDD may bear the CE mark for the next 3 years up to 2023. However, the MDR implies that PMS activities (Chapter VII) apply in full force as of May 2020. That means that when the PMS activities show that the clinical data is not sufficient your medical device needs a design change (or change in Instructions For Use) or is at risk for losing its CE mark. Also, the new MDR does not allow for grandfathering meaning that products that are currently on the market will not automatically be approved to stay on the market.

So what steps do MD companies need to undertake?


First, companies are well advised to perform an analysis of their current clinical evidence (Clinical Evaluation Report) in reference to the MDR. Three likely outcomes could be:

  • All is fine, ‘no worries’.
  • Major issues meaning there’s a lot of work and you should start rather sooner than later
  • So many issues that you consider discontinuing your product and withdraw it.

This implies that companies with products on the market within the European Union who find themselves in the second category will need to come up with a transition plan to be compliant with these new rules and they have until May 25th, 2020 to do so. In a previous blog, we already explained the options and respective consequences (MDD -> MDR) suggesting that action should be taken in a timely fashion.


Based on the assessment outcome, a clinical strategy proves to be very useful. The clinical evaluation plays a central role in this process. The MDR describes that the process is started with a clinical evaluation plan during the development process of the product. During this phase of the products life cycle, the clinical evaluation used to be finalized and included in the submission package to the NB, under the MDD. Under the MDR, the process of clinical evaluation continues during the life cycle of the product, and depending on the risk class of the product, needs to be updated regularly. E.g. for class IIB and III, this needs to be done annually, even when your device is CE marked under the MDD as described above.

We could identify several main options depending on the extent of the necessary upgrade. The clinical evaluation report needs updating:

  • An update of literature data (together with vigilance) seems to be sufficient
  • An update of literature data alone is insufficient:
    • Clinical data needs to be collected via a clinical investigation
    • Clinical data needs to be collected via Medical Device Vigilance (article 87 and 88) and PMCF (Annex III - 1.1 - b)


To extend the clinical data or evidence, you can perform an investigation or post-market follow up study (PMCF). In case you are considering to extend the intended use, this might be the best moment to start a clinical investigation. It will help you to increase the clinical evidence but also broaden the intended use at the same time. If you only need to increase the clinical data, a PMCF might be more applicable and cost-effective.


As a manufacturer of CE marked products, you should carefully plan to ensure that the most efficient solution for meeting the requirements for clinical evidence is found and implemented in time. You do not want to lose your CE certificate and thereby access to the marked and your revenue. A timely upgrade of your clinical evaluation to meeting the MDR requirements will lead to the highest chances for success. It will also help you to identify if additional actions are required to collect the clinical evidence.


Wrapping up we’d like to emphasize that it all boils down to timing from this points onwards, Beware that the deadline of May 2020 is less than two years away. Being aware of the upgrade requirements for your medical device assures business continuity.


  1. Assess your current clinical evidence
  2. Set up a clinical strategy accordingly
  3. Perform additional clinical studies if needed
  4. Plan your improvements

If you would like some more specific information on the clinical strategy in line with the regulatory requirements, do not hesitate to leave us a message.

Blog by: Jan Bart Hak

Read more


You have built a fantastic Excel sheet and successfully finalized the validation. However, are you able to use/operate your Excel sheet and keep its flexibility and familiarity that comes with it up to date as well? In addition, preferably without suffering from validation chaos? In this blog, we’ll explain how to do just that.

“No matter the popularity of spreadsheets, when used improperly or incorrectly, or without sufficient control, spreadsheets pose a greater threat to your business than almost anything you can imagine.” – Phillip Howard, Boor Research

First off, is your Excel sheet validated already? If not, you might want to start out by reading our previous blog:

 #6 Quick Tips About Excel Sheet Validation

After you have finished this one you want to ask yourself the following questions:

  • Are you confident with the fact that your Excel sheet is validated?
  • Have you already created your User Requirement Specifications and performed your Installation and Operation Qualification?
  • Is your Excel Sheet Validation Report already approved?

Thinking about these questions, make sure that your validation documentation is complete and covers all applicable regulations and guidelines. As soon as this is accomplished, your Excel sheet is ready for deployment and ready for its operational phase.

1. QMS Documentation

First, make sure that all necessary QMS (Quality Management System) documentation for the maintenance of the Excel sheet is present and up to date such as Incident Management, Audit Trail Review, Periodic Review, etc. The frequency for the periodic evaluation of these procedures should be determined based on a Risk Assessment.

2. Inventory list

Additionally, an inventory list may provide you with a clear overview of all your Excel sheets. Your inventory list may contain:

  • Spreadsheet name and number
  • Current version
  • Area(s) where used
  • Spreadsheet Owner
  • Location of the template

By noting down these items the list will help you to keep track which Excel sheets have been validated, where they are being used, and for what.

3. Infrastructure

Is your Infrastructure qualified and in a state of control that would satisfy your Excel sheet validation? Once the validated Excel sheet is in its operational phase, all records and evidence produced to meet the regulatory requirements must be stored and/or archived over the entire lifecycle of a product, often over decades. Therefore, it is always good to think about the building of your infrastructure and check if it can provide a huge amount of data e.g on a daily basis.

4. Implementation

Now you can start implementing your Excel Sheet. To achieve that, follow your deployment procedure and make sure that your validated and approved Excel spreadsheet has been released properly. Store your template and the data entered into the spreadsheet in a secure location with access limited to selected authorized users. If your site policy requires storage of an electronic copy of the Excel sheet application file, the file should be stored under a new name in a designated area on the server.

5. Operational reliability & Training

To be able to demonstrate (to inspectors and auditors) that your Excel sheet is always in compliance during its operation you may need to have in place:

To be able to demonstrate (to inspectors and auditors) that your Excel sheet is always in compliance during its operation you may need to have in place:

I. A User Administration Procedure which should include:

  • Access/security levels available for the Excel sheet
  • How to change user roles and rights

II. A User Work Instruction which should provide information about:

  • How to operate the spreadsheet
  • Where and what kind of data should be entered
  • How to process your final results

III. Training

  • You should be able to provide a documented evidence that all appropriate employees are adequately trained

6. Traceability, Changes Management & Inspections

Even a perfectly validated Excel sheet needs changes from time to time, for example, due to changes in your working method. You should always document all changes made in the Excel sheet, as part of the change control, and keep track of these changes using version numbers. This ensures that each version is easily referenced and traced. Never delete older Excel sheet versions. Old versions should be decommissioned and stored separately from the active ones. This is important for tracking changes, mistakes, etc. and is a major point to regulatory authorities during their inspections and audits. The inventory list may help you to keep track of traceability of all changes performed on the Excel sheet.

7. Risk management & Re-Validation

Is it necessary to re-validate the Excel Sheet after a change has been performed? When and what do you need to re-validate?

In general, any change performed on a validated Excel sheet template may cause a significant harm, especially during operation and maintenance. In order to be able to analyze possible impacts on Patient Safety, Product Quality and Data Integrity, you should perform a detailed Risk Assessment as well as intensive validation support to maintain compliance and to recover the validated status. A risk-based approach helps you to define which parameters of the application are critical and reduce their risk to the minimum. The result will help you to define your validation effort. If the risk assessment determines that the change is minor or does not affect the spreadsheet requirements, only limited testing, focused on the affected system object, would be required to demonstrate that the system has maintained its validated state. Major changes will require additional re-validation and critical changes could trigger and demand an entire re-validation of the Excel sheet.


It doesn't matter whether your Excel sheets are used for the administration of production equipment, recording and graphical presentation of cleanroom monitoring data or for conducting statistical analyses in quality assurance. Once these activities are related to GMP requirements, your Excel sheets need to be validated and will most likely draw the attention of any inspector and/or auditor. In consequence, regulatory requirements must be met in a reliable way during and after validation while the effort is kept within limits.

So, wrapping up here’s the list key points to look into when developing, validating and maintaining your own Excel sheets for GxP environments:

  1. Availability of all QMS & Validation documentation following GAMP (Good Automated Manufacturing Practice)
  2. Creating an inventory of all your Excel sheets
  3. Building a secure infrastructure
  4. Reliable Excel sheet implementation
  5. Operational reliability & Training to users
  6. Traceability & Change management, and inspection readiness
  7. Risk Management & Re-validation

Keep in mind that this blog isn’t meant to be exhaustive and we encourage you to contact us if you have any remaining questions!

Blog by: Silviya Della Chiave

NEW: We invite companies who are looking for an efficient way to validate their Excel sheets in an optimal way. You provide the necessary information and we'll provide you with a compliant sheet. Check it out!

Read more

#GDPR & Pharmacovigilance: What's changing?

Today, 25 May 2018, the new General Data Protection Regulation (GDPR) 2016/679 came into force in the European Union, replacing Directive 95/46/EC. The GDPR regulates "the protection of natural persons with respect to the processing of personal data" (Art. 1), insofar as this takes place in the context of the activity of a branch in the EU (irrespective of whether the processing takes place in the EU) or itself the persons concerned are in the EU (see Art. 3). At the same time with the GDPR, an adapted Federal Data Protection Act (BDSG-new) came into force in Germany, which should take into account the new GDPR.

Beforehand, the debate on the new laws has already been heated up by highlighting possible sanctions: companies risk dramatic fines of up to four percent of last year's sales or EUR 20 million if they fail to comply with the new data protection rules. How serious are the changes at all, and what is actually changing within the pharmacovigilance practice? Let’s have a look at four essential areas of the pharmacovigilance practice:

  • Processing of assignments
  • Documentation of processes
  • Reporting of adverse events
  • Clinical Studies andMedical Information Service 

1. Processing of assignments

If personal data is to be processed by a service provider, the qualification of the contracting party must be checked before the processing of an assignment is made and a written processing contract (Data processing Agreement) must be concluded in accordance with Art. 28 GDPR. The qualification is assessed by reviewing the technical and organizational measures and their documentation by examining certificates or similar evidence that can serve as guarantees (see Art. 32 GDPR). In the case of subcontractors, they are subject to the same data protection obligations arising from the contract between the service provider and the responsible entrepreneur (see Art. 28 GDPR). For the pharmacovigilance practice, this means adapting the contracts with clients and subcontractors according to the standards of the new legal requirements.

2. Documentation of processes

According to Art. 9 and 30 GDPR, the processing of personal health data is subject to specific regulations. All data processing activities must be recorded. The record may be kept in writing or electronically and must be provided to the supervisory authorities on request. The GDPR also suggests documenting the action of each data processing operation as well as the data protection compliance measures (see Art. 5 and 24 GDPR). Other new requirements for the processing of personal health data are the data protection impact assessment prior to the start of the data processing (see Art. 35 GDPR) and the reporting requirements of data breaches within 72 hours (see Art. 33 u. GDPR 37). The appointment of a data protection officer is obligatory (see Art. 37 GDPR). For the pharmacovigilance practice, these aspects lead to a slightly higher documentary effort.

3. Reporting of adverse events

The GDPR demands numerous new information obligations to data subjects regarding affected persons: Precise specification of the legal basis for data collection, duration of data storage, naming the responsible person for data collection, name and contact details of the data protection officer, information on the right to complain, information on data transfer to third countries, if applicable (see Art. 12, 13 and 14 GDPR). The basis of adverse event reports is personal data of the affected patients and the reporting persons (physicians, pharmacists, patients).

The German Association of Research-Based Pharmaceutical Companies (vfa) has already criticized a draft of the BDSG-new due to prospective excessive bureaucratic effort and the lack of flexibility in the pharmacovigilance practice: "The obtaining of a data protection consent form is in a variety of cases of the survey of adverse events practically unrealistic, since patients' health and the drug safety must first and foremost be a focus at these moments "(vfa statement 01.02.2017). However, a positive change in the legislative amendment for pharmacovigilance activities should be highlighted: Art. 9 GDPR and its adaptation in § 22 of the BDSG-new set up the legal basis to transfer personal data without the consent of the person concerned in order to ensure high safety standards in health care and for medical products.

The new legal situation can be interpreted in such a way that in individual cases a post-marketing service provider may be allowed to process personal health data, even if, for example, a person reporting a serious adverse event explicitly disagrees on that.

4. Clinical Studies and Medical Information Service

Personal health data are relevant in pharmacovigilance, especially in the context of clinical trials and the Medical Information Service. The scope of the data collection is a further critical aspect of pharmacovigilance practice in addition to the obligation to provide a huge amount of information about processed data to the affected person (information obligation). The pseudonymisation of patient data to a minimum, which is regulated in Art. 4 and 12 GDPR, could lead to multiple reports of the same case of adverse reactions and impair the quality of drug safety (see also vfa statement 01.02.2017).

An adaptation of the German Medicinal Products Act (AMG), which is planned for this legislative period, may be able to eliminate such legal uncertainties.

For the Medical Information Service, the information obligation regarding affected persons means that persons requesting medical information (e. g. patients, pharmacists, physicians) have to be instructed by the service provider (information giver) more extensively than before about their rights.


The consequences of the GDPR (and BDSG-new) lead to a higher amount of work for pharmacovigilance in the processing of assignments, the documentation of processes, the reporting of adverse events as well as in clinical studies, and in regard with the Medical Information Service. In individual cases, excessive bureaucracy and lack of flexibility in the pharmacovigilance practice are criticized. Overall, the changes to the legal requirements do not have a major impact on pharmacovigilance activities.