What is a Data Management Plan?
The Data Management Plan (DMP) is the study-level document that describes how clinical data will be collected, managed, validated, cleaned, and transferred throughout the life of a clinical trial. It is produced by CDM at study start-up and maintained as a living document throughout the study, updated whenever the protocol, data collection methods, or data flow changes.
The GCDMP (Good Clinical Data Management Practices, SCDM, 2013) defines the DMP as the primary study-level reference document for all CDM activities. It is also an essential document under ICH E6(R3) — one of the required records specified in Appendix 3 — and must be filed in the eTMF (Zone 09 under the TMF Reference Model).
The DMP is not a template that can be filled in on the first day. It requires input from clinical operations, data standards, EDC programming, biostatistics, medical coding, safety, and vendor management. A well-constructed DMP takes 2–4 weeks to draft for a complex study, and should be finalised and approved before first patient in.
Core DMP sections required under GCDMP
The GCDMP chapter on DMPs defines the minimum content of a compliant Data Management Plan. Every DMP should include the following sections:
1. Study overview and scope
A summary of the study — protocol number, phase, indication, sponsor, CRO (if applicable), target enrolment, number of sites, and planned timeline. This section also defines the scope of CDM activities: which data elements CDM is responsible for and which are managed by other functions.
2. Roles and responsibilities
Named individuals or roles responsible for each CDM activity, aligned to the study RACI matrix. Under ICH E6(R3) §3.3, the allocation of trial-related duties must be clearly documented. The DMP is where study-specific accountability is established — the SOP defines the departmental process, the DMP defines who is responsible for this specific study.
3. Data flow and system architecture
A description or diagram of how data moves through the study: from source at site (or eSource), into the EDC system, through any external data transfers (lab, IRT, ePRO, ECG, imaging), and ultimately into the analysis database. Each data pathway should specify the transfer method, frequency, format, and validation procedure.
4. Source data specification
This section — which has become more important under ICH E6(R3) — specifies what constitutes source data for each data type in the study, and whether that source data is the EDC record (eSource) or a transcribed copy of a paper or electronic source. This is effectively the Source Data Agreement, and it should be included in or referenced by the DMP.
5. EDC system and study build
Identification of the EDC platform, study build version control approach, UAT process, and go-live criteria. Includes the reference to the approved annotated CRF and the Data Validation Specification.
6. Data standards and conventions
Reference to the applicable CDASH version, controlled terminology standard and version, date format (ISO 8601), and any study-specific conventions. This section ensures consistency across EDC programmers, DM team, and downstream SDTM mapping.
7. Data review procedures
A summary of how data will be reviewed — the review listings categories, review frequency, and who conducts each review. In ICH E6(R3) compliant DMPs, this section should reference the RBQM Risk Register and explain how CtQ factors drive the data review priorities. This is often a reference to the Data Review Plan (DRP), which may be maintained as a separate document.
8. Query management
Query text standards, response timelines by query type, aging escalation thresholds, and the irresolvable query process. The DMP should define the query rate targets that feed into the CDM KPI dashboard.
9. Medical coding
Dictionary names and versions (MedDRA, WHODrug), coding conventions, verbatim coding standards, and the review and approval process for coded terms.
10. External data management
For every external data provider — central lab, IRT, ePRO, ECG, imaging — the DMP specifies the data transfer specification, transfer frequency, format validation procedure, reconciliation process, and the CDM contact responsible for each vendor interface.
11. Database lock procedure
The pre-lock review steps, clean room period definition, lock authorisation process, and unlock/relock procedure. The DMP should specify which stakeholders must sign the database lock form and the sequence of sign-offs.
12. Archiving and retention
The archival package contents, archival timeline, storage system, and applicable retention periods by jurisdiction.
What ICH E6(R3) added — sections most DMP templates are still missing
DMPs written against ICH E6(R2) or GCDMP 2013 alone are missing several elements that ICH E6(R3) has either introduced or elevated to explicit requirements:
RBQM integration: E6(R3) §3.10 requires a risk-based approach to quality management. The DMP should include a section — or clear reference to the RBQM Risk Register — that explains how CtQ factors identified at study design are operationalised into the data review process. Most R2-era DMPs do not include this.
Source data designation: E6(R3) §4.2.1 is more specific than R2 about what constitutes source data and the requirements for eSource systems. The DMP should include explicit Source Data Agreement language for every data type — a table that lists each data element, its source (paper, EHR, EDC as eSource, wearable, etc.), and the procedure for its capture.
Decentralised trial data: If the study uses any remote or decentralised data collection — home nursing, telemedicine visits, wearables, patient-reported outcomes via app — the DMP must address how this data is captured, validated, and reconciled with ALCOA+ compliance. ICH E6(R3) Annex 2 (expected finalisation 2025–2026) will formalise these requirements further.
Data privacy: If the study enrolls participants in the EU, the DMP should reference the data privacy framework — the legal basis under GDPR Article 9(2)(j), the pseudonymisation standard, and the cross-border transfer mechanism.
"An inspection-ready DMP is not one that was written to a template and never updated. It is a document that was current on the day the database locked — showing the actual data flow, the actual vendor list, the actual coding dictionaries used. The DMP that was written at start-up and never updated is a compliance risk."— Sarah Huntley, 25+ years CDM experience
CDM Library
Data Management Plan Template
A complete, GCDMP-structured DMP template in Word format — all 12 required sections, ICH E6(R3) compliant including RBQM integration, source data designation, and data privacy sections. Immediately customisable. Pairs with CDM-SOP-025 (Data Review Plan Preparation) for a complete start-up documentation set.
Related articles: What Is RBQM? ICH E6(R3) §3.10 Explained · CDM SOPs for Small Biotechs