GDP Compliance Pack: Share Your WDA, Verify Your Partners (2026)

Last updated: August 2026

I'm Sean Yu, co-founder of Peony, and I spend my days looking at how confidential documents move between businesses that do not fully trust each other. Pharmaceutical wholesale is one of the sharpest versions of that problem, because Good Distribution Practice turns the compliance pack into a two-way street. You do not just hold your licences in a drawer for an inspector. You have to show yours — your Wholesale Distribution Authorisation, GDP certificate, Responsible Person CV, SOP index, insurance and recalls procedure — to every manufacturer onboarding you and every customer running supplier qualification. And you have to check theirs — the law obliges you to qualify the bona fides of the suppliers you buy from and the customers you sell to, before you deal. Email is structurally unable to keep that pack current or prove it was delivered, and that gap is the subject of this post.

Quick answer. GDP makes the compliance pack a two-way obligation: you must present your own pack (WDA licence, GDP certificate, RP CV, SOP index, insurance, recalls procedure) to counterparties, and you must verify trading partners' bona fides before dealing — qualifying both suppliers and customers. EU GDP Guidelines 2013/C 343/01 require this at sections 5.2 and 5.3; MHRA Guidance Note 6 calls it establishing the "bona fides" of suppliers and purchasers. Email cannot keep the pack current after a licence variation or prove who received which version. A Peony data room (free, $0) keeps the pack behind one always-current, watermarked link, collects qualification evidence inbound, and logs who opened what — priced per admin, counterparties free. Peony is not a QMS and does not manage deviations or CAPAs; for that, buy an eQMS.

Where this post sits. My colleague's Data Room for Pharmaceutical Distribution guide owns the commercial flow — gating a prescription-only catalogue to verified trade buyers, isolating per-account price lists, and shipping certificates of analysis. This post owns the regulatory-qualification exchange — showing your own licences and pack, and verifying your partners' bona fides. Same wholesaler, two different jobs. If your problem is the price list and the catalogue, read that post; if it is the WDA, GDP certificate, and supplier qualification, you are in the right place. For the horizontal price-list job, see Share Price Lists and Product Catalogs Securely.

What is a GDP compliance pack, and who asks for it?

A GDP compliance pack is the bundle of regulatory documents a licensed wholesaler produces to prove it is a legitimate, authorised distributor — and manufacturers, customers, and auditors all ask for it constantly.

In the UK, if you sell or supply human medicines to anyone other than the patient, you must hold a wholesale distribution licence, and to qualify you must comply with Good Distribution Practice and pass regular GDP inspections of your site, according to GOV.UK guidance. That licence, and the GDP certificate that follows a successful inspection, are the headline items — but the pack is more than two certificates. When a new manufacturer onboards you, or a hospital pharmacy runs you through supplier approval, they ask for a fuller set, because they are discharging their own qualification obligation by checking yours.

Here is the pack most wholesalers end up assembling and re-sending, over and over:

The pattern I see is always the same. This pack is emailed as a zip of PDFs to a manufacturer's onboarding team, then a fortnight later to a customer's qualification analyst, then again to another counterparty — each copy frozen at the moment it was sent. The day your GDP certificate is reissued after an inspection, every one of those copies is out of date, and you cannot reach into an inbox to update it. That is the structural weakness this post is about.

Why is the GDP compliance pack a two-way obligation, not just something you hold?

Because GDP does not only require you to be authorised — it requires you to satisfy yourself that everyone you trade with is authorised too. You must show your pack, and you must check theirs. That reciprocity is the thing most storage tools miss, and it is written into the guidelines.

Start with the outbound half. Your counterparties ask for your pack because they are legally obliged to qualify you. The EU GDP Guidelines 2013/C 343/01, which the UK's post-Brexit regime tracks closely, set this out in two adjacent sections. Section 5.2, "Qualification of suppliers," states: "Wholesale distributors must obtain their supplies of medicinal products only from persons who are themselves in possession of a wholesale distribution authorisation, or who are in possession of a manufacturing authorisation which covers the product in question." Where product comes from another wholesale distributor, the receiving distributor "must verify that the supplier complies with the principles and guidelines of good distribution practices and that they hold an authorisation... for example by using the Union database," per the EUR-Lex text.

Now the mirror. Section 5.3, "Qualification of customers," states: "Wholesale distributors must ensure they supply medicinal products only to persons who are themselves in possession of a wholesale distribution authorisation or who are authorised or entitled to supply medicinal products to the public," again per the EUR-Lex text. Read 5.2 and 5.3 together and the two-way street is unmistakable: you qualify who you buy from, and who you sell to — and every counterparty is doing the same to you. That is why your pack is in constant circulation.

A precise wording note, because it matters for how you cite this. The EU guidelines use "qualification" and "due diligence." They do not use the phrase "bona fides" — that phrase is the MHRA's own. In Guidance Note 6, the MHRA describes the hazards of poor distribution as including "purchasing suspect or falsified products, failing to establish the 'bona fides' of suppliers and purchasers, inadequate record keeping, and so on," and adds at section 12.5 that "rigorous checks should be made on the bona fides of the supplier and the origin of the product." So when you write "bona fides" in an SOP, attribute it to MHRA guidance, not to the EU text — the EU text says "qualification." Both point at the same duty; only the MHRA phrases it that way.

Who owns this duty inside your business? The Responsible Person. The RP must be named on the wholesale dealer's licence, and MHRA guidance is blunt that "only the Responsible Person(s) named on a wholesale dealer's licence have legal responsibility for the organisation's compliance and remain responsible for any duties that have been delegated," per Guidance Note 6. Ensuring suppliers and customers are approved is one of the RP's key duties. There is even an agreed competency benchmark: a Responsible Person Gold Standard was approved in April 2014, which, per Guidance Note 6 section 9.2, "sets out an industry-agreed framework that identifies the skills required in four competency areas." So the RP's name and CV belong in your outbound pack, and the RP is accountable for the inbound checks — both halves of the two-way street run through the same role.

Why does email fail the compliance pack specifically?

Because email does two things badly that the pack cannot tolerate: it freezes the document at the moment of sending, and it keeps no reliable record of delivery. For a pack that changes after every variation and must be provably qualified, those are not minor annoyances — they are the failure.

Take currency first. Your GDP certificate is reissued after each inspection, and your WDA changes whenever you make a variation — GB WDAs are not on a fixed annual renewal cycle at all; they are maintained through periodic risk-based GDP inspection, with variations processed as you make them. GOV.UK notes that a new application "should take 90 working days to process," while "variations to licences should take 30 working days to process," extended to 90 if the variation requires an inspection, per the licensing guidance. So the trigger for refreshing your pack is a licence variation or an SOP update, not a birthday. Now imagine you have emailed your pack to two hundred counterparties over three years. A variation lands. Every one of those copies is now stale in inboxes you cannot reach — so either manufacturers are qualifying you on out-of-date documents, or you spend a day re-emailing two hundred zips, then repeat it at the next variation.

A link you control has one job here that email structurally cannot do: when the document behind it changes, everyone who holds the link sees the new version. The pack stays current without a mailing round.

Now delivery. Qualification is a duty you must be able to evidence — who you checked, what you sent, and when. An email attachment gives you none of that reliably: you cannot prove the counterparty opened it, that it was the current version, or which partner is still opening a superseded certificate. When an auditor or an MHRA inspector asks how you know a partner had your current pack, "I emailed it at some point" is not evidence. A logged link is — it records who opened the pack, when, and which version. GDP runs on proof, not assumption.

How do you actually run the register checks — MHRA GMDP and the VMD register?

You request the partner's licence copy before trading, then verify it against the correct public register — and post-Brexit, choosing the correct register is what people get wrong. For human medicines in Great Britain it is the MHRA GMDP database; for veterinary wholesale it is the VMD's register. EudraGMDP is no longer the live UK check for GB.

MHRA guidance describes the workflow plainly: request trading partners who wholesale or manufacture human medicines to supply a copy of their licence before trading commences, and make subsequent, continuing checks against the register of licence holders, per Guidance Note 6. Two steps: collect the copy, and check the register.

Step 1 — Collect the licence copy inbound. Do not chase it over email. Send the counterparty a single file-collection upload link and let them submit their WDA copy, GDP certificate, and completed questionnaire in one place, tied to their record and timestamped.

Step 2 — Check the correct register yourself. This is your legal duty and it stays manual — no tool does it for you. For human medicines, GOV.UK directs you to "view authorised manufacturer's of medicines and authorised wholesalers of medicines by visiting the MHRA GMDP website," which holds the searchable Wholesale Distribution Authorisations and GDP certificates. Critically, post-Brexit the live UK check is the MHRA GMDP database, not EudraGMDP: UK documents issued up to and including 31 December 2020 remain viewable in EudraGMDP but are no longer updated there from 1 January 2021, except documents relating to Northern Ireland sites, per the GOV.UK guidance. So for a GB counterparty, use the MHRA GMDP database; for an NI site, EudraGMDP still applies.

For veterinary wholesale, the register is different. A veterinary wholesaler's authorisation can be checked on the VMD's public Register of veterinary-only Wholesale Dealer Sites, which lists authorised sites with the authorisation number, holder, address, and most recent inspection date.

Step 3 — Store the evidence with the partner's file. Keep the licence copy they sent and a dated note of your register check together, so the qualification record is reconstructable years later — the inbound copy, the questionnaire, and your check note in one partner file, not scattered.

A GDP certificate reflects compliance at the last inspection, so treat the register as the source of current status rather than assuming a certificate is valid forever. If a partner's status has changed, the register shows it before an emailed PDF ever would.

How do you run qualification questionnaires without the Excel-attachment chaos?

By collecting them through an inbound link instead of emailing a spreadsheet back and forth. The questionnaire stops being an attachment that spawns five conflicting versions and becomes a single submission tied to the counterparty and timestamped.

The familiar mess: you email a supplier-qualification questionnaire as an Excel file, they fill part of it and email it back, you ask for corrections, they return a differently-named copy, and three months later — when an auditor asks — nobody is sure which version is authoritative. Multiply that across dozens of onboardings a year and the qualification record becomes an archaeology project.

Replace the round-trip with file-collection. You send one upload link, and the counterparty submits their completed questionnaire, their WDA copy, their GDP certificate, and anything else you specify — in a single place, without an account. Everything arrives tied to that counterparty, timestamped, alongside the rest of their file. You review it, make your qualification decision, and the record is reconstructable. The register check still stays your process — the room does not confirm their WDA for you — but the evidence-gathering around it is clean.

This is the same underlying job as the horizontal guide to collecting documents from clients securely — here the "clients" are your suppliers and customers, and the documents are the raw material of your qualification file.

What does a GDP inspector expect for documentation and audit trail?

Controlled, version-managed, auditable documents, retained for at least five years — and evidence that you qualified your partners. An access-logged room maps onto that pattern, though no tool makes you compliant on its own. (This section stays on the qualification file; for the catalogue-and-price-list side of document control — per-account gating and certificate-of-analysis versioning — see the pharmaceutical distribution guide.)

Retention first, because there is a persistent myth to kill. EU GDP Chapter 4 is headed "Documentation," and states that "documents should be retained for the period stated in national legislation but at least five years," per the EUR-Lex text. The UK aligns: MHRA Guidance Note 6 requires you to "keep the documents or records available to the licensing authorities, for inspection purposes, for a period of five years," per Guidance Note 6, and the Human Medicines Regulations 2012 require records of medicines supplied to be kept for "a minimum period of five years," per legislation.gov.uk. It is five years, not the seven people sometimes assume. Write five in your SOPs.

Then the qualification evidence. Because qualifying suppliers and customers is a named RP duty, an inspector will reasonably expect to see that you did it — the licence copies you collected, the register checks you made, and when. A room supports this three ways:

• Version control — the pack lives behind stable links, and replacing the file retires the old version without breaking the address, so the current pack is what opens.
• Auditable access — every view and download is logged, so "who opened which version, and when" is answerable rather than reconstructed from memory.
• Retained evidence — inbound licence copies, questionnaires, and access logs persist across the five-year window in one place, instead of scattering across inboxes.

Now the honest boundary, because I have watched vendors overclaim here. No software is "GDP-certified," and no tool makes you compliant. Compliance is your quality system, your people, and your procedures. What a room does is support the documentation-control and evidence-of-qualification pattern GDP expects. When an inspector asks how you know a customer had your current GDP certificate, or how you qualified a supplier, an access log and a dated partner file beat pointing at a shared drive. That is a real benefit — and a different claim from "this makes you compliant," which would be false.

What does the always-current pack actually look like in practice?

One link to the pack, version-controlled and watermarked to each viewer, shared with every counterparty who needs it — current by default rather than by chasing. This is the practical shape of everything above.

You assemble the pack once — WDA, GDP certificate, RP CV, SOP index, insurance, recalls procedure — into a room, and share a single access link, gated behind an NDA or a counterparty's onboarding terms if you want. Then the mechanics do the work:

• Currency without mailing rounds. After a variation or an SOP update, you replace the affected file behind the link once, using update-links, and every counterparty holding the link opens the current version next time — no re-emailing two hundred partners.
• A leaked copy is traceable. Dynamic watermarking stamps each copy of the pack with the viewer's identity and a timestamp, so a forwarded PDF points back to who opened it. The pack is not secret, but you still want to know a circulated copy came from a specific counterparty.
• Delivery is proven, not assumed. Page-analytics record who opened the pack, when, and which version — the evidence email cannot produce.
• Access ends with the relationship. When a partnership ends, you revoke access and their link goes dark. An inbox full of your documents does not.

Cost, plainly. I run Peony, a data room company. Peony is free to start at $0; the Business plan is $30 per admin per month; and the Data Room plan — which adds dynamic watermarking and unlimited rooms — is $52 per admin per month on annual billing. The model that matters for a wholesaler is per admin, recipients free: you pay for your internal admin seats, and every counterparty you share the pack with is free. A family-run wholesaler with two admins and hundreds of trade partners pays for two seats — which is why 6,800+ customers run controlled sharing on Peony without their bill scaling with their audience.

Now the boundary that keeps me honest, and it is a real one. Peony is not a QMS. It does not manage your deviations, CAPAs, change control, SOP lifecycle, or training records. Those are the internal machinery of GDP, and if you need to manage them in software, you need an eQMS — I concede that lane entirely and will not pretend a data room fills it. What Peony handles is the exchange layer: sharing your pack outbound so it stays current and provable, collecting qualification evidence inbound, and logging both. Many small wholesalers run their SOPs and CAPAs in an eQMS, or a well-disciplined file system, and use a room purely for the two-way counterparty exchange. Being clear about that boundary is exactly why the 6,800+ customers who use Peony know what job it is doing — exchange, and evidence of exchange, which is precisely the gap email leaves.

What does the two-way exchange look like for a veterinary wholesaler?

The same, with a different regulator and register — and the veterinary case is worth working through because a whole cluster of family-run veterinary-pharma wholesalers live this daily.

A veterinary wholesaler needs a "wholesale dealer's authorisation (WDA)" from the Veterinary Medicines Directorate (VMD), not the MHRA. GOV.UK states that "the VMD is responsible for inspecting and authorising veterinary medicines wholesale dealers," per the veterinary WDA guidance. The statutory term in the Veterinary Medicines Regulations 2013 is "wholesale dealer's authorisation"; you will also see "WDA(V)" as a vet-specific shorthand in VMD material, which is fine, but the full phrase is the statutory one. Two practical differences shape the pack.

Validity. A veterinary WDA is "valid indefinitely subject to satisfactory inspections," and "wholesale dealer premises will generally be inspected at least every 4 years," per the veterinary WDA guidance. So the update trigger is, again, a variation or an inspection outcome — not an annual renewal. The always-current-link logic applies identically.

Register. You and your counterparties verify each other against the VMD's Register of veterinary-only Wholesale Dealer Sites rather than the MHRA GMDP database. A vet wholesaler that also carries human medicines — common, because the veterinary cascade lets a vet prescribe a UK-authorised human medicine when no suitable veterinary product exists — checks both registers depending on the counterparty and product.

So the worked example runs like this. A vet-pharma wholesaler assembles its pack — VMD WDA, RP CV, SOP index, recalls procedure — behind one link, and shares it with the manufacturers onboarding it and the practices qualifying it. Inbound, it collects each new customer's authorisation evidence through an upload link and checks it against the VMD register (or the MHRA GMDP database, for human-medicine counterparties). After its next four-yearly inspection, it updates the affected documents once, and every counterparty sees the current pack. Two-way, current, and logged — the only manual step being the register check the law requires the RP to make.

Two canon points to keep straight while we are here. Controlled-drug requisitions for Schedule 2 and 3 CDs still require the original wet-ink signed requisition before supply — e-signatures do not cover them. And Summaries of Product Characteristics are public documents, searchable on products.mhra.gov.uk, so never treat an SPC as confidential.

Frequently Asked Questions

A manufacturer is onboarding us as a distributor — how do we share our WDA licence and GDP certificate securely?

Put the pack behind one link instead of attaching PDFs. Your WDA licence, GDP certificate, Responsible Person CV, SOP index, insurance and recalls procedure sit in a room, and you send the counterparty a single access link — gated behind an NDA or their onboarding terms if you want. When your GDP certificate is reissued after an inspection, you swap the file behind the link and the manufacturer opens the current one, not last year's. You also get a log of who opened what and when, which is the delivery record email cannot give you. The manufacturer still verifies your WDA independently against the MHRA GMDP database — the link does not replace their register check, it makes the pack current and the delivery provable.

Our compliance pack goes stale after every licence renewal — how do we stop re-emailing it to everyone?

The problem is that an email attachment is frozen the moment you send it. Keep the pack behind a stable link instead, and after every licence variation or SOP update you replace the file behind that link once — everyone holding the link now opens the current version. There is no round of re-emailing hundreds of counterparties, and no risk that a manufacturer is qualifying you on a superseded GDP certificate. GB WDAs are not renewed on a fixed annual cycle; they are maintained through periodic risk-based GDP inspection, and variations are processed as you make them. So the trigger for updating the pack is a variation or an SOP revision, not a calendar date — and a link means that update propagates itself.

Supplier qualification questionnaires keep getting lost as Excel attachments — what's the better system?

Stop routing questionnaires as Excel round-trips. Use an inbound file-collection link so a counterparty submits their completed questionnaire, their WDA copy and their GDP certificate through one upload, without needing an account. Everything lands in one place, tied to that counterparty, timestamped, instead of scattered across inboxes with three versions of the same spreadsheet. You review, you make the qualification decision, and the record sits with the rest of that partner's file. The register check stays your process — you still confirm their WDA on the MHRA GMDP database or the VMD register. The room removes the attachment chaos and gives you an auditable trail of when qualification evidence arrived and who reviewed it.

GDP says we must verify trading partners' bona fides — how do we run WDA checks against the MHRA/VMD registers without endless email?

MHRA Guidance Note 6 tells you to request a copy of the partner's licence before trading starts, then make continuing checks against the register. For human medicines in Great Britain that register is the MHRA GMDP database, not EudraGMDP, which froze for UK records at 31 December 2020 except Northern Ireland sites. For veterinary wholesale it is the VMD's Register of veterinary-only Wholesale Dealer Sites. Collect the licence copy through an inbound link rather than email, check the register yourself, and store both the copy and a note of your register check in that partner's file. The check is your legal duty and stays manual; the room removes the email round-trips and gives you a dated record that qualification happened.

How do we prove which counterparty received and reviewed which version of our pack?

This is exactly what email cannot do and a link can. Every access link records who opened the pack, when, and which pages they viewed, so you can show that a specific manufacturer opened the current GDP certificate on a specific date. When you replace a document after a variation, the analytics carry forward, so you can also show who was still opening the previous version and needs a nudge. Compare that with an attachment: once sent, you have no idea whether it was opened, and no way to prove it was the current one. An access trail turns delivery from an assumption into evidence, which is the kind of record that supports a documentation-control conversation with an inspector.

Is emailing our GDP certificate and Responsible Person CV as PDF attachments an audit risk?

The certificate and RP CV are not secret, so the risk is not disclosure — it is currency and control. An emailed PDF is frozen: after your next inspection or a change of Responsible Person, every copy in every inbox is out of date, and you cannot recall or update them. You also have no record of who is relying on which version. A link fixes both: you update the file once and every holder sees the current pack, and you get a log of access. It also lets you revoke a counterparty's access when a relationship ends, which an inbox full of your documents does not. The problem with email here is version drift and no delivery record, not leakage.

Do GDP inspectors expect a record of who we shared our compliance documents with?

GDP is built on controlled, auditable documentation. EU GDP Chapter 4 requires documents to be retained for at least five years, and MHRA Guidance Note 6 requires records be kept available to the licensing authority for five years — five, never seven. Qualification of your suppliers and customers is a named Responsible Person duty, so the evidence that you checked a partner's bona fides, and when, is part of that record. A room that logs who accessed which version of your pack, and where you store inbound licence copies and questionnaires, produces that evidence as a by-product. No software makes you compliant — your quality system does — but an access trail is a far better answer to an inspector than a shared drive nobody can reconstruct.

Do we need a full QMS, or is a data room enough for GDP document exchange?

They are different tools and you may need both. A quality management system manages your deviations, CAPAs, change control, SOP lifecycle and training records — the internal machinery of GDP. Peony does none of that and I would not pretend otherwise; if you need an eQMS, buy an eQMS. What a data room handles is the exchange layer: sharing your pack outbound so it stays current and provable, collecting qualification evidence inbound, and logging both. Many small wholesalers run their SOPs and CAPAs in an eQMS or even a well-disciplined file system, and use a room purely for the two-way counterparty exchange. Match the tool to the job — the room is for exchange and evidence of exchange, not for managing your quality system.

Can we keep one always-current compliance-pack link that updates itself after a renewal?

Yes — that is the core of the approach. You create one link to the pack and share it with every counterparty who needs it. After a licence variation, an inspection that reissues your GDP certificate, or an SOP update, you replace the file behind the link once, and everyone holding the link opens the new version the next time they visit. Nobody re-downloads a stale PDF, and you do not re-email hundreds of partners. Because GB WDAs are maintained through inspection rather than a fixed annual renewal, the update trigger is a variation or SOP change, and the link means that change reaches everyone automatically. One link, version-controlled, watermarked to each viewer — current by default rather than by chasing.

What does this cost for a small wholesaler — is roughly $52/month realistic?

Yes. Peony is free to start at $0. The Business plan is $30 per admin per month, and the Data Room plan — which adds dynamic watermarking and unlimited rooms — is $52 per admin per month on annual billing. The detail that matters for a wholesaler is per-admin pricing with recipients free: you pay for your internal admin seats, and every counterparty you share the pack with, or collect a questionnaire from, is free. A family-run wholesaler with a couple of admins and hundreds of trade partners is not paying enterprise money. That $52 tier is the one most GDP setups want, because watermarking each copy of the pack with the viewer's identity is what makes a leaked document traceable.

Sources

• EU GDP Guidelines 2013/C 343/01 (EUR-Lex) — sections 5.2 and 5.3 (qualification of suppliers and customers) and Chapter 4 "Documentation" (retain "at least five years").
• MHRA Guidance Note 6 (GDP) — "bona fides" of suppliers and purchasers (ss 12.3, 12.5), RP named on the licence, RP Gold Standard approved April 2014 (s 9.2), five-year record-keeping.
• GOV.UK — apply for manufacturer or wholesaler of medicines licences — WDA requirement, GDP certificate per inspected site, 90/30 working-day timelines, MHRA GMDP vs EudraGMDP post-Brexit.
• MHRA GMDP database — the live UK register of Wholesale Distribution Authorisations and GDP certificates.
• GOV.UK — apply for a veterinary medicine wholesale dealer's authorisation — VMD as issuer, WDA terminology, valid indefinitely subject to inspection ~every 4 years.
• VMD Register of veterinary-only Wholesale Dealer Sites — the veterinary authorisation check.
• Human Medicines Regulations 2012 (SI 2012/1916) — UK human-medicine wholesale regime, five-year record retention.
• Veterinary Medicines Regulations 2013 (SI 2013/2033) — UK veterinary wholesale regime.
• MHRA Products (SPCs) — Summaries of Product Characteristics are public, searchable documents.

Related resources

• Data Room for Pharmaceutical Distribution — the commercial-flow sibling: gated catalogue, per-account price lists, and certificates of analysis
• Share Price Lists and Product Catalogs Securely — the horizontal how-to for keeping price lists current and gated
• Is a Price List a Trade Secret? — when your pricing counts as protectable confidential information
• Digital Catalog Software vs Data Room — weighing catalog tools against a gated room for trade documents
• Collect Documents From Clients Securely — run inbound qualification questionnaires and licence collection without email chaos
• How to Set Up a Data Room — the step-by-step for structuring your first room
• Document Sharing Compliance Guide — the broader compliance view of controlled document exchange
• How to Send Confidential Documents via Email — why attachments fail and what to send instead
• Pharma solutions — the pharmaceutical distribution solution page