Pharma API QR Code Generator

What the notification says

G.S.R. 20(E) was notified by the Ministry of Health and Family Welfare on 18 January 2022 and became mandatory on 1 January 2023. It amends the Drugs and Cosmetics Rules 1945 and applies to every active pharmaceutical ingredient manufactured in or imported into India.

The requirement is a QR code on the label at each level of packaging, storing data readable by a software application. Eleven particulars are listed as the minimum: unique product identification code, name of the API, brand name if any, name and address of the manufacturer, batch number, batch size, date of manufacturing, date of expiry or retesting, serial shipping container code, manufacturing or import licence number, and special storage conditions where any apply.

The stated purpose is traceability: allowing an ingredient to be followed through the supply chain, and making it harder for spurious material to enter it. That intent matters for interpretation, because a code that technically contains the fields but cannot be read by anyone downstream does not serve it.

The part the rule does not specify

The notification says what the code must contain. It does not say how the data should be structured inside it, and that omission is responsible for most of the confusion around implementation.

Two approaches are in common use. Labelled plain text puts each particular on its own line, which means anyone scanning with an ordinary phone camera sees readable information immediately, including an inspector or a customer with no special software. Structured formats such as JSON parse cleanly into a receiving system and look like code to anyone without one.

Neither is prescribed and both satisfy a plain reading of the requirement. The choice is really about who is expected to scan it. For material moving between businesses that have agreed a format, structured data is better. For anything that might be scanned by someone outside that arrangement, readable text is safer.

Why GS1 identifiers cannot carry the whole list

GS1 Application Identifiers are the standard way of encoding supply chain data, and a good deal of guidance around this rule assumes they are the answer. They are only part of it.

GS1 defines identifiers for several of the required particulars: 01 for the product identifier, 10 for batch or lot, 11 for production date, 17 for expiry, and 00 for the serial shipping container code. Those cover five of the eleven.

There is no standard identifier for the manufacturer's address, the batch size, the licence number or the storage conditions. Which means a pure GS1 element string cannot hold everything the notification requires, and any implementation claiming otherwise is either omitting fields or using private identifiers that nobody else will interpret. That is the practical reason structured text remains the common choice for the API code itself, whatever else appears elsewhere on the label.

Dates, and the ambiguity worth avoiding

Two of the eleven fields are dates, and the notification does not prescribe a format. That leaves room for a genuinely dangerous ambiguity: 03/04/2026 is the third of April in India and the fourth of March in the United States, and API moves internationally.

ISO format, four digit year then month then day, removes the problem entirely and sorts correctly as text. It is the format used here for that reason.

The expiry field carries a second subtlety. The rule says date of expiry or retesting, and for many APIs a retest date is what applies: the material does not expire so much as require re-analysis before further use. Labelling a retest date as an expiry date understates the usable life and can cause perfectly good material to be discarded, so the distinction is worth carrying through into the code rather than flattening.

The serial shipping container code

SSCC is a GS1 identifier for a logistics unit: a pallet, a drum, a shipping container. It is eighteen digits, and the last of them is a check digit calculated from the preceding seventeen using the same modulo 10 weighting as a GTIN.

It identifies the container rather than the product, which means it belongs on shipping-level packaging rather than on every unit. A manufacturer applying the same SSCC to every drum in a consignment has misunderstood what it is for: each logistics unit gets its own.

Getting the check digit wrong produces a code that any GS1-aware system downstream will reject, and the failure typically surfaces at a customer's goods-in rather than at your own dispatch. That is why the digit is calculated here rather than accepted on trust.

Printing it so it survives the warehouse

API labels live on drums, sacks and fibre containers, which are handled, stacked, dragged and stored in conditions that paper does not enjoy. That changes the printing decisions from the ones that suit a retail box.

Error correction should be Q or H rather than the M that suits a clean surface. Those levels tolerate roughly 25% and 30% damage respectively, which is the difference between a scuffed label that still scans and one that does not.

Module size matters more than overall dimension. A physically large code with a small module is harder to scan than a smaller one with generous modules. Somewhere around 0.5 mm per module is a reasonable floor for industrial handheld scanners, which at typical data volumes puts the printed code in the 25 to 40 mm range.

Then the material. Thermal transfer onto synthetic label stock survives handling and solvents in a way that direct thermal on paper does not, and direct thermal labels fade with heat, which is exactly what a warehouse in summer provides.

What this tool is not

It generates a code. It does not store anything, keep records, or produce an audit trail, and those absences are deliberate rather than incidental.

Traceability in the sense the notification intends is a process rather than an image: knowing which code went on which drum, which drum went to which customer, and being able to reconstruct that months later when a question arises. Commercial platforms exist for exactly that, they integrate with ERP and labelling systems, and for a manufacturer at any scale they are the right answer.

What was missing was the free end of that spectrum. A small manufacturer producing a few batches a month needs a correct code and a printable sheet, and was being quoted for an enterprise deployment. This closes that gap and does not pretend to close the other one.

The regulation itself is the authority on what compliance requires, and a regulatory adviser is the person to interpret it for your operation. Nothing on this page is legal advice, and the sensible use of it is to generate the code, verify what it encodes against your label, and keep the records elsewhere.