In pharmaceuticals, a barcode is not a marketing nicety — it is a legal requirement and a patient-safety control. The World Health Organization estimates that around 1 in 10 medical products in low- and middle-income countries is substandard or falsified. To fight that, regulators worldwide now demand that each pack of medicine carry a machine-readable, serialized code that proves exactly what it is, which batch it came from, when it expires, and that it is genuine. This guide is written specifically for drug manufacturers: what the QR (and DataMatrix) rules actually require, how serialization and aggregation work, and how to implement it without failing an audit.
This is the pharma-specific companion to two guides you should read alongside it: our deep dive on the GS1 DataMatrix (how the tiny 2D code on medicines is built and encoded) and our product serialization guide. Here we focus on the regulations, the data fields, and the packaging hierarchy unique to medicines.
The Regulatory Landscape: Who Requires What
Unlike most consumer goods, medicine coding is mandated by law in every major market. The exact rules differ by region, but they share a common goal: serialize every saleable unit so it can be authenticated and traced. Here is the landscape a manufacturer selling into these markets has to satisfy.
Figure 1 — Major pharmaceutical serialization mandates
🇮🇳 India — Top 300 Brands QR
Rule (Schedule H2), effective Aug 2023: a QR code or barcode on the label of the top 300 drug brands, encoding eight mandated data fields.
🇪🇺 EU — FMD
Falsified Medicines Directive, in force Feb 2019: a serialized GS1 DataMatrix (unique identifier) plus a tamper-evident seal, verified through the EMVS.
🇺🇸 USA — DSCSA
Drug Supply Chain Security Act: package-level serialization and interoperable, electronic unit-level tracing, phased in from 2023 onward.
🌐 India — Export Track & Trace
DGFT rules require barcoding at primary, secondary and tertiary levels for exported drugs, with data uploaded to the national portal.
Enforcement dates and scope change over time — always confirm the current requirement with the relevant regulator before a print run.
The Eight Data Fields India's QR Mandate Requires
India's rule is unusually specific and consumer-facing, which is why it is worth calling out in detail. For the notified top 300 brands, scanning the code must make eight pieces of information available. If you sell any of these brands, your QR must carry all of them:
Figure 2 — The eight mandated fields (India, Schedule H2)
The clean way to store these is a GS1 Digital Link: the GTIN, batch and expiry sit inside the URL using standard identifiers, and the remaining descriptive fields load from the record it points to. The pack stays compliant even if you switch software vendors.
QR Code or GS1 DataMatrix? Choosing the Right Symbol
A common source of confusion: pharma uses two different 2D codes, and they are not interchangeable. Which you print depends on the pack and the market. In short — DataMatrix for the tiny regulated identifier, QR when you also want a patient to scan with a normal phone.
Figure 3 — When to use which 2D code
GS1 DataMatrix
- Smallest footprint — fits a blister strip, vial or ampoule
- Mandated by EU FMD and US DSCSA
- Read by warehouse and pharmacy 2D scanners
- Not reliably read by a phone camera
QR Code
- Scanned by any patient's phone, no app
- Accepted under India's top-300 rule
- Opens a branded verification / info page
- Needs more room — suits a carton, not a strip
Many manufacturers print both: a DataMatrix carrying the serialized identifier for the supply chain, and a QR for the patient. For how the DataMatrix is structured, see our DataMatrix guide.
Serialization and Aggregation: From Blister to Pallet
Serialization means every saleable unit gets a unique serial number (GS1 Application Identifier 21) on top of its product number, batch and expiry — so no two packs of the same medicine are identical. Aggregation is the step most manufacturers underestimate: linking each unit's serial to the carton it goes into, and each carton to the pallet, so the whole shipment can be verified by scanning the outer code alone. This parent-child relationship is what makes recalls and customs checks fast.
Figure 4 — The packaging hierarchy (parent-child aggregation)
💊 Unit pack (each carton of tablets)
(01) GTIN + (21) serial + (10) batch + (17) expiry
📦 Shipper carton (holds 50 unit packs)
(00) SSCC — linked to all 50 child serials
🏗️ Pallet (holds 40 cartons)
(00) SSCC — linked to all 40 child cartons
Scan one pallet code and the system knows every carton and every one of the 2,000 unit serials inside it — without opening the box.
Who Scans the Code — and Why It Matters
A pharmaceutical code is read at every stage of the journey, by four very different people, each answering a different question. Designing for all four is what separates a compliant implementation from a box-ticking one.
Figure 5 — Four people who scan a medicine pack
Patient
"Is this genuine and not expired?" — phone scan.
Pharmacist
"Decommission this pack at the point of dispense."
Distributor / Customs
"Verify a whole shipment from the pallet code."
Regulator
"Trace a suspect batch back to its source."
For the supply-chain event data that ties these scans together, see our EPCIS traceability guide. For a recall walkthrough, see how QR codes enable faster recalls.
Example: A Serialized Medicine Carton
Here is how the elements sit on a secondary carton for the Indian market: the human-readable fields, a serialized QR the patient can scan, and a note on the supply-chain DataMatrix.
Figure 6 — Example medicine carton: human-readable fields + serialized QR
PARACIP-500
Paracetamol Tablets IP 500 mg • 10 tablets
Scan to verify this pack
Common Mistakes That Fail an Audit
- Confusing a batch code with a serial. A batch groups thousands of packs; a serial (AI 21) is unique to one pack. Serialization mandates require the serial — a batch number alone is not compliant.
- Skipping aggregation. If cartons and pallets are not linked to their child units, every downstream partner has to open boxes and re-scan. Build the parent-child links at packing.
- Reusing serial numbers. Each (21) must be unique within a GTIN, and typically not repeated even after the product cycles. Duplicate serials break verification and flag as counterfeit.
- Printing the identifier without a valid GTIN check digit. One wrong digit invalidates the whole code. Verify with our check digit calculator before committing artwork.
- Choosing QR where DataMatrix is required (or vice versa). EU FMD and US DSCSA expect a GS1 DataMatrix; India's top-300 rule accepts a QR. Print the code the target market's law specifies.
- Poor print quality on foil and small cartons. Low grade, no quiet zone, or ink spread on blister foil are the top causes of unreadable pharma codes. Grade every code against ISO/IEC 15415 and test on the real substrate.
How TrueGTIN Helps Pharma Manufacturers
TrueGTIN gives smaller and mid-size drug manufacturers the serialization tooling that used to require enterprise software:
- Generate serialized codes at scale — unique (21) serials per pack, encoded as GS1 DataMatrix or QR, exported as a print-ready CSV.
- Build GS1 Digital Link QR codes that carry GTIN, batch and expiry and open a branded verification page — ready for India's top-300 requirement.
- Aggregate unit → carton → pallet with SSCCs, so a single outer scan reveals the full contents.
- Validate every GTIN and calculate check digits for free with our GTIN validator.
- Manage batches and recalls from one dashboard, with live scan activity and a genuine-or-recalled answer for anyone who scans.
Frequently Asked Questions
Do I need a QR code or a GS1 DataMatrix on medicine?
It depends on the market. The EU (FMD) and the US (DSCSA) require a serialized GS1 DataMatrix on saleable packs. India's rule for the top 300 brands accepts a QR code or a barcode. Many manufacturers print both — a DataMatrix for the supply chain and a QR for patients.
What is the difference between serialization and aggregation?
Serialization gives each individual saleable pack a unique serial number. Aggregation records which packs went into which carton, and which cartons onto which pallet, so the hierarchy can be verified by scanning only the outer code. You generally need both for full traceability.
Can a patient scan the pharma QR with an ordinary phone?
Yes — that is the point of using a QR rather than only a DataMatrix. Any modern phone camera reads a QR with no app, opening your verification page. A DataMatrix, by contrast, usually needs a dedicated 2D scanner.
Which drugs must carry the QR code in India?
The requirement currently applies to a notified list of the top 300 drug brands, with the code on the primary or secondary package label. Scope can expand over time, so check the latest notification for your products.
Does the QR replace the printed batch number and expiry?
No. The human-readable batch number, manufacturing date and expiry must still be printed on the pack. The QR (or DataMatrix) adds a machine-readable, serialized layer on top of that mandatory text.
Serialize and Verify Every Pack — Free to Start
TrueGTIN generates serialized QR and DataMatrix codes, handles unit-to-pallet aggregation, and gives patients a one-scan authenticity check — built for pharma compliance.