DRAP Track and Trace System: What It Means for Pharma Software

Oct 23, 20266 min read

DRAP track and trace system: 2D barcode on medicine packaging

Since 9 October 2026, every registered medicine made in or imported into Pakistan must carry a 2D barcode with its own serial number. The Drug Regulatory Authority of Pakistan (DRAP) confirmed this in a circular dated 8 October, calling it Phase 1 of its Pharmaceutical Track & Trace System (DRAP circular, 8 Oct 2026). Most coverage has focused on printing the codes on packs. This article looks at the other half: the software that has to read, store and share them.

What the DRAP track and trace system requires

The Federal Cabinet approved nationwide track and trace for pharmaceutical products in June 2026, along with amendments to the Drugs Labelling and Packing Rules, 1978 (PID, 2 Jun 2026). The legal instrument is S.R.O. 963(I)/2026.

According to DRAP’s circular:

Phase 1 covers all locally manufactured and imported pharmaceutical products and requires a unique 2D Data Matrix barcode and serialization.
It applies to products made or imported on or after 9 October 2026. Earlier batches are exempt and may still be imported, distributed and sold.
The aims are to curb spurious, falsified, counterfeit and unregistered medicines, to make product recalls work as one integrated process, and to give real-time supply chain transparency.
DRAP has warned of legal action under the relevant laws for non-compliance.

The technical detail is in DRAP’s Guidelines on GS1 DataMatrix Barcode and Serialization of Pharmaceutical Products, effective 28 July 2026 (DRAP Guidelines). Everything below about data and systems comes from that document unless another source is linked.

What is inside the 2D barcode

Each unit at the secondary packaging level (usually the outer carton of a pack) must carry a GS1 DataMatrix holding four data elements, each marked by a GS1 Application Identifier (AI):

AI	Data	Format
(01)	GTIN (product identifier)	14 digits
(17)	Expiry date	YYMMDD
(10)	Batch or lot number	Up to 20 characters
(21)	Serial number	Random hexadecimal, 12 to 20 characters

A few rules matter to developers:

The brackets around AIs on the printed text are for people only and must not be encoded in the barcode.
The DataMatrix starts with the FNC1 character, which tells scanners to read the data under GS1 rules.
Serial numbers can be upper or lower case, but each organisation must be consistent.
Primary packaging (blister or bottle) is exempt for now. Shipper cartons get up to six years. When they are marked, a carton of one product may carry a DataMatrix plus a GS1-128 barcode with an SSCC (a unique carton number), and a mixed carton carries only the SSCC.

Where software comes in

The guidelines say the system must support marking, scanning and accept/reject logic. Data is exchanged in platform-independent CSV, XML or JSON. The system needs secure authentication, authorisation and audit trails, plus business rules that accept or reject scan events, detect duplicates and flag anomalies. That reaches well beyond the packaging line.

Manufacturers and importers

Manufacturers and importers must register with GS1 for their GTINs and location numbers (GLNs), register with DRAP’s information system, and produce master data files (CSV/XML) and transaction or event files (XML) for submission to DRAP. They must generate a unique serial number for every unit, with a low enough chance of two units sharing one, and keep the parent-child link between units and the cartons they are packed in.

For the ERP, this means:

Serial numbers created and stored against the batch record, not only in the printer’s software.
Master data (GTINs, products, pack sizes) kept in one place, so the barcode and the DRAP submission always match.
Event data uploaded to DRAP for every supply chain step where feasible.
All submitted data kept for at least three years after the product expires.

Distributors and wholesalers

Distributors, wholesalers and retailers must register with DRAP, get GLNs, and run systems that can scan barcode data and connect to DRAP as required. They must also report suspect products.

In a distribution system, goods receipt and dispatch become scanning steps. Scanning a pack should fill in the product, batch and expiry automatically and record the serial against the delivery. If a serial has already been received or sold, the system should stop and flag it instead of letting it through.

Pharmacies and point of sale

At the counter, a POS that reads the DataMatrix can record the batch and expiry of each item sold. That makes recalls easier: when a batch is withdrawn, the system can show at once whether it is in stock or who bought it. Because packs made before 9 October remain legal, the POS must handle barcoded and older packs side by side for some time.

Consumer verification

DRAP plans a mobile app that reads the DataMatrix and checks it against DRAP’s records. On 15 October the health minister said pharmacies, medical stores and citizens will be able to use it to check whether a medicine is genuine and see its price and expiry date (Business Recorder, 16 Oct 2026). No launch date has been announced, so internal systems should not depend on it.

Practical points for development teams

Parse, don’t guess. Batch and serial are variable-length fields. Use a proper GS1 parser that handles the FNC1 start and variable-length fields, instead of cutting strings at fixed positions.
Store the serial as an identity. Treat GTIN plus serial as a unique key, so duplicates are caught by the database and not only by staff.
Design for offline scanning. Warehouses and pharmacies lose connectivity. Mobile and handheld apps should queue scans and sync them later, with clear conflict handling.
Keep an audit trail. Record who scanned what, where and when. The guidelines call for audit trails, and they also help when settling disputes with suppliers.
Plan for aggregation. Cartons are not required yet, but recording parent-child links now avoids redesigning the data model when tertiary marking arrives.

These choices sit across the ERP, the warehouse, the POS and any mobile scanning app, so they are best planned together. For related work, see our ERP and POS software, mobile app and web application development pages.

Frequently asked questions

What is the DRAP track and trace system?

It is DRAP’s national system for tracing medicines from manufacture to sale using 2D barcodes and unique serial numbers. Phase 1 applies to products made or imported on or after 9 October 2026 (DRAP circular).

What is SRO 963(I)/2026?

It is the notification amending the Drugs (Labelling and Packing) Rules that requires 2D barcodes and a track and trace system for medicines. DRAP’s guidelines implement it (DRAP Guidelines).

What is 2D barcode serialization?

It means giving every saleable pack its own serial number and encoding it, with the GTIN, batch and expiry, in a GS1 DataMatrix. In DRAP’s system the serial is a random hexadecimal string of 12 to 20 characters (DRAP Guidelines).

How can I check if a medicine is original or duplicate in Pakistan?

The health minister has said a mobile app will let pharmacies and citizens scan the 2D barcode to check whether a medicine is genuine and see its price and expiry (Business Recorder, 16 Oct 2026). DRAP’s guidelines also provide for consumer verification through a mobile app.