The data management plan is the first document that decides whether your database lock will be uneventful. It defines how clinical data will be collected, reviewed, validated, coded, reconciled and locked, and it aligns clinical operations, biostatistics, monitoring and data management before the first participant is enrolled.
Chief Data Officer
Biometrics & Data Systems
in clinical data systems, biometrics and statistical reporting
Head of Quality & Compliance
ISO 14155 & data integrity
in quality systems and inspection readiness for device studies
Chief Operating Officer · former TÜV SÜD Senior Reviewer
in device evaluation and Notified Body review
A controlled document describing every process applied to clinical data during the study. It is the operating manual everyone works from, not a formality produced for the trial master file.
Clinical investigations generate thousands of data points from investigators, laboratories, imaging systems, wearables and patient-reported outcomes. Without a structured plan those inconsistencies accumulate quietly, and they surface on the critical path. The plan is one part of the broader clinical data management scope.
Scope, ownership and the lock date all sit in the same document. See how we build a data management plan for a medical device trial as part of end-to-end EDC and data management.
The plan should be drafted once protocol development has progressed and before the EDC database is locked down. Early drafting lets the data strategy influence decisions that are expensive to reverse.
Which forms exist, what each one collects, and how visits map to them. See eCRF design.
Which checks fire automatically, which discrepancies need a human, and which are not worth a query at all.
Who reviews what, how often, and what triggers escalation.
Transfer frequency, file formats and reconciliation rules, agreed with vendors before the first transfer.
Dictionaries, versions, conventions and who signs off the coded terms.
Who can enter, who can query, who can close, who can lock, and what the audit trail records.
Waiting until enrollment has begun means amendments, revalidation and avoidable cost. This is the same reason data management belongs inside study start-up rather than after it.
A data management plan written for one jurisdiction breaks in a multinational investigation. Consent wording, hosting, transfer rules and registry access enter the plan explicitly.
Data protection rules, hosting requirements and registry access vary by country and are settled before the database is built, not after the first patient is enrolled.
Every study is different, but a plan missing one of these will be found out at some point in the study, usually late.
Title, protocol number and version, sponsor, objectives, investigation type, participating countries and sites. Everyone works from one context.
Sponsor, clinical data manager, CRA, investigator, statistician, medical monitor, database programmer, coding specialist. A responsibility matrix settles this once.
eCRFs, external laboratory data, imaging, device-generated data, ePRO, wearables and the transfer specifications for each.
Visit schedule, forms, variables, controlled terminology, edit checks, dynamic logic, user roles and audit trails.
Automatic edit checks, manual review, cross-form consistency, missing data detection, range and logical validation.
Generation criteria, review process, investigator responsibilities, response timelines, closure and escalation.
Dictionaries such as MedDRA and WHO Drug, coding conventions, version management, review process and responsibilities.
Central laboratories, ECG providers, imaging vendors, randomization systems, device telemetry, electronic diaries.
Peer review, database testing, validation documentation, data review meetings and metrics monitoring, documented throughout.
The conditions required before locking, who authorizes it and how the documentation is archived. See database lock.
Applying the same level of review to every variable is a decision, and usually the wrong one. The plan documents the risk assessment and what it changes.
Critical efficacy endpoints, patient safety variables, primary analyses and key protocol data get enhanced oversight. Lower-risk information is handled through automation and targeted review. The reasoning and the method are set out on the risk-based data management page.
Requirements differ by region, but the principle does not: regulators expect a sponsor to demonstrate that clinical data is accurate, complete and traceable across the study lifecycle.
Teams that want the underlying framework rather than a document review can start with our ISO 14155 training, or with the clinical evaluation chain the data eventually feeds.
The data management plan, the clinical protocol and the statistical analysis plan have to agree on the population, the endpoint definitions and the handling of missing data. When they do not, the disagreement is discovered during analysis, at the point where it costs the most to resolve.
Published work and client evidence, not claims.
Where this document sits in the wider data lifecycle.
The clinical data manager owns it, drafting with clinical operations, biostatistics, medical monitoring and regulatory. The sponsor approves it. A plan written by one function alone tends to be unworkable for the others.
Before the database goes live and before the first participant is enrolled. Approving it later means the database was built against assumptions rather than an agreed plan.
Long enough to answer the ten questions above for this study, and no longer. A practical study-specific plan beats a comprehensive document that is never consulted.
Yes, whenever a process changes: a protocol amendment affecting data collection, a new external vendor, a change to the coding dictionary version, a revised review strategy. Each version is controlled and the rationale documented.
Yes. A gap review against ISO 14155, the protocol and the analysis plan, focused on the parts that usually break: validation scope, external data reconciliation, coding conventions and lock criteria.
The two documents have to agree on population definitions, endpoint derivations and missing data handling. The data management plan describes how the data arrives clean, the analysis plan describes what is done with it.
Send us the protocol and the current draft. We come back with a gap review against ISO 14155 and the analysis plan, and the list of decisions that need settling before the database is frozen.
Your documents are reviewed confidentially. An NDA can be put in place before we receive any technical or clinical information. You can also reach the team through the contact page.
Whitepaper, BSI and Eclevar
on the EU MDR
Client testimonial,
RegenLab