Data Retention and Storage in Research

By Dr. Zubair Khalid, DVM, MS, PhD · 2026-08-28

Quick Answer

• Keep research data for the period required by your funder, institution, or journal, and document that period in a data management plan before collection begins.
• Store data in secure, access-controlled repositories with backup systems, and use encryption for sensitive or identifiable information.
• Data retention is not indefinite, and destruction must follow ethical and legal requirements that vary by jurisdiction, data type, and funding source.

Understanding Data Retention in Research

Data retention refers to the practice of preserving research records, raw data, analyzed datasets, and supporting documentation for a defined period after a study concludes. The purpose of retention is to allow verification of results, support reproducibility, enable reanalysis, and provide evidence of responsible conduct if questions arise about the research.

Researchers often face uncertainty about how long to keep data and what to do with it after the retention period ends. This uncertainty creates risk. Data kept too briefly may be lost before verification is possible. Data kept too long may create privacy, security, or legal liabilities. Data destroyed improperly may violate funder requirements or institutional policy.

The decision framework in this article helps researchers determine retention periods, select storage methods, and execute ethical destruction. The framework draws on guidance from the National Institutes of Health, the Committee on Publication Ethics, and the EQUATOR Network. These sources provide expectations for data management, publication ethics, and transparent reporting.

Retention decisions are not purely technical. They involve professional judgment, institutional policy, and jurisdiction-specific requirements. A researcher must distinguish between what the evidence recommends, what their institution requires, and what the law mandates. This article clarifies those boundaries.

Core Principles of Data Retention

Integrity and Reproducibility

Data retention supports research integrity by preserving the evidence behind published claims. When a reader, reviewer, or regulator asks to see the data supporting a finding, the researcher must be able to produce it. The Committee on Publication Ethics states that journals should expect authors to make available the data that support their published claims, and that authors should be prepared to provide this data if requested. This expectation creates a practical obligation to retain data for a reasonable period after publication.

Reproducibility depends on more than the raw numbers. The research team must also retain the metadata, codebooks, analysis scripts, and version histories that explain how the data was collected and processed. Without this supporting documentation, the raw data may be unintelligible to an independent reviewer.

Transparency in Reporting

Transparent reporting is a core expectation in research. The EQUATOR Network provides a collection of reporting guidelines that help researchers describe their methods and results clearly and completely (EQUATOR Network). These guidelines do not directly specify retention periods, but they reinforce the principle that research should be documented well enough for others to understand and evaluate. Data retention is the practical extension of that principle. If the data is gone, the transparency of the reporting cannot be verified.

Funder Expectations

Funding agencies increasingly require data management and sharing plans as part of grant applications. The NIH Data Management and Sharing Policy describes expectations for planning, storing, and sharing scientific data generated from NIH-funded research (NIH Data Management and Sharing Policy). Researchers who receive NIH funding must submit a data management and sharing plan at the time of application. The plan must describe how data will be preserved and shared, including the repository to be used and the timeline for sharing.

The NIH Grants and Funding portal provides the official context for grant policy, application, review, and award management (NIH Grants and Funding). Researchers should consult their specific funding agreement because retention requirements can vary by award type, program, and data sensitivity.

Institutional Policy

Every research institution has its own policies for data retention, storage, and destruction. These policies often exceed funder requirements. Institutional policies may specify minimum retention periods, approved storage systems, and procedures for disposal. Researchers must know their institution's policy before they begin a study, not after the data is collected.

At a Glance

The table below summarizes the key decisions a researcher must make for data retention, storage, and destruction. The table is a starting point for planning, not a substitute for institutional or funder policy.

Building a Data Management Plan

A data management plan is the primary tool for making retention decisions before the research begins. The plan should be written at the start of the project and updated when the scope of the research changes.

What the Plan Must Address

The plan should describe the types of data that will be collected, the formats used, the storage systems, the backup procedures, the access controls, and the retention period. It should also describe the method of destruction or disposal at the end of the retention period.

For NIH-funded research, the data management and sharing plan must be submitted with the grant application and must describe how the data will be preserved and shared (NIH Data Management and Sharing Policy). The plan is not a formality. It is reviewed as part of the application and becomes part of the award terms.

When to Update the Plan

The plan should be updated when the research design changes, when new data types are added, when collaborators join or leave, or when the funding agreement changes. A plan that is written once and never reviewed is not a plan. It is a document.

Who Should Approve the Plan

The plan should be reviewed by the institutional research office, the data steward, or the principal investigator's department. The approval process ensures that the plan is consistent with institutional policy and that the researcher has the resources needed to execute it.

Secure Storage Options

Storage is the practical implementation of the retention decision. The storage method must protect the data from loss, corruption, unauthorized access, and accidental disclosure.

Institutional Repositories

Most research institutions provide a repository for storing research data. These repositories are managed by the institution and offer access control, backup, and versioning. The repository is the preferred storage location because it is maintained by professionals and is designed for long-term preservation.

Cloud Storage

Cloud storage is convenient and widely used. The researcher must verify that the cloud service meets institutional requirements for security, data location, and access control. Not all cloud services are appropriate for research data, especially data that is sensitive or identifiable.

Local Storage

Local storage on a researcher's computer or an external drive is the least reliable option. Local storage is vulnerable to hardware failure, theft, and accidental deletion. It should be used only for temporary working copies, not for the primary retention copy.

Backup Strategy

A backup strategy is separate from the storage location. The researcher should maintain at least one backup copy of the data in a different physical location. The backup should be tested regularly to confirm that it can be restored. A backup that has never been tested is not a backup.

Data Documentation and Metadata

Data retention is not complete if the data cannot be understood. The researcher must retain the documentation that explains the data.

Metadata

Metadata is the descriptive information that explains what the data is, how it was collected, and what the variables mean. Metadata should be recorded at the time of collection, not reconstructed later. The metadata should be stored with the data and should be versioned when the data changes.

Codebooks and Analysis Scripts

Codebooks define the variables, codes, and values used in the dataset. Analysis scripts document the steps used to transform raw data into the results reported in the publication. Both must be retained to allow a third party to reproduce the analysis.

Sharing and Access

Sharing is the act of making data available to others. The data management plan should define who can access the data and under what conditions. Access may be open, restricted, or controlled by a data access committee. The access conditions must respect the consent given by research participants and the privacy requirements of the data.

Ethical Destruction of Research Data

Destruction is the final stage of the data lifecycle. The decision to destroy data must be made deliberately and documented. Destruction is not the same as deletion. Deletion removes the data from a visible location but may leave recoverable copies on the storage medium. Destruction makes the data unrecoverable.

When to Destroy Data

Data should be destroyed when the retention period has ended and no legal, funder, or institutional requirement requires further retention. The researcher should confirm that the retention period has ended before proceeding. If there is any doubt, the data should be kept.

Methods of Destruction

The destruction method depends on the data type. Physical media such as paper records, hard drives, and tapes should be shredded, incinerated, or physically destroyed. Digital data should be securely erased using software that overwrites the data multiple times or by destroying the physical medium. The method must be appropriate to the sensitivity of the data.

Documentation of Destruction

The destruction should be documented. The record should include the date, the method, the person who performed the destruction, and the data that was destroyed. This documentation provides evidence that the data was handled responsibly.

Common Failure Patterns

Researchers often make predictable mistakes in data retention. Recognizing these patterns helps to avoid them.

Failure to Plan

The most common failure is the absence of a data management plan. The researcher collects data without deciding how long to keep it, where to store it, or how to destroy it. When the study ends, the data is left in an unmanaged state.

Storage on Personal Devices

Storing research data on a personal laptop, phone, or personal cloud account is a common failure. The device may not be backed up, may not be encrypted, and may not be accessible to the institution after the researcher leaves. The data may be lost or may be inaccessible when needed.

No Backup

The researcher keeps the data in one location and does not maintain a backup. When the drive fails or the file is corrupted, the data is lost. The loss may not be discovered until the data is needed for verification.

Deletion Without Documentation

The researcher deletes data without recording what was deleted, when, or why. The deletion cannot be verified, and the researcher cannot demonstrate that the destruction was ethical and complete.

Ignoring the Retention Period

The researcher assumes that the retention period is the same for all data. The period may vary by funder, institution, and data type. The researcher who does not verify the period may destroy data too early or retain it too long.

Limitations and Professional Judgment

The guidance in this article is a framework, not a rulebook. The researcher must apply professional judgment to the specific circumstances of the study.

Jurisdiction-Specific Requirements

Data retention and destruction are subject to laws that vary by jurisdiction. Privacy laws, data protection laws, and research regulations may impose requirements that are stricter than the general guidance. The researcher must know the requirements that apply to the data and the location of the research.

Institutional Policy Overrides

Institutional policy may be stricter than the general guidance. The researcher must follow the institutional policy even when it exceeds the minimum requirements. The institutional policy is the binding requirement.

Funder Requirements

The funding agreement may specify retention periods, storage locations, and destruction methods. The researcher must follow the funding agreement. The agreement is the binding requirement for the funded portion of the research.

When to Escalate

The researcher should escalate to a supervisor, the institutional research office, or the data steward when the retention decision is unclear, when the data is sensitive, when the funder or institutional policy is ambiguous, or when the data is subject to a legal hold. The researcher should not make a unilateral decision when the consequences are uncertain.

Building a Retention Decision Matrix for Mixed Datasets

Research projects rarely produce a single uniform dataset. A clinical study may combine survey responses, laboratory measurements, interview recordings, and administrative records. Each of these data types carries different sensitivity levels, consent conditions, and regulatory obligations. Applying one retention period to all of them creates two risks. A single short period may force destruction of data that still has verification value. A single long period may hold identifiable data longer than the consent agreement allows. The retention decision matrix resolves this problem by assigning a separate retention decision to each data class within the project.

Defining Data Classes Before Collection

The matrix begins with a data inventory. Before any collection starts, the research team lists every data type the project will generate. Each data type becomes a class. The class definition should include the format, the source, the sensitivity level, and the consent or authorization that governs it. For example, a project may define these classes: signed consent forms, survey responses with direct identifiers, survey responses with identifiers removed, laboratory results linked to participant IDs, laboratory results with identifiers removed, audio recordings of interviews, and field notes.

The inventory must be written down. A mental list is not sufficient because the matrix will be used months or years later, often by a different team member. The inventory should be part of the data management plan and should be updated when the research design changes. The NIH Data Management and Sharing Policy requires that the plan describe the types of scientific data the project will produce, which makes the inventory a direct component of the planning process (NIH Data Management and Sharing Policy).

Assigning Retention Periods by Class

Each data class receives its own retention period. The period is determined by the most restrictive applicable requirement among funder terms, institutional policy, journal expectations, and legal obligations. The researcher does not choose the longest or shortest period. The researcher identifies the binding requirement for each class and applies it.

The following categories help structure the assignment:

Verification data. These are the data that directly support the published findings. They include the analyzed dataset, the analysis scripts, and the metadata needed to interpret them. The retention period must extend beyond the publication date to allow peer review and post-publication verification. The Committee on Publication Ethics expects authors to retain data that support published claims and to be prepared to provide it when requested (Core Practices). For most projects, this class receives the longest retention period.

Identifiable participant data. These are data that can be linked to a specific person. The retention period is constrained by the consent agreement and by privacy regulations. The data may need to be destroyed earlier than the verification data, or it may need to be retained longer if the consent agreement promises a specific duration. The researcher must check the consent form language. If the consent form does not specify a duration, the institutional policy and applicable law govern.

Source documents. These include consent forms, recruitment logs, and original paper records. They are often subject to institutional retention rules that differ from research data rules. The institution may require that consent forms be kept for a specific number of years after the study closes, independent of the data retention period.

Incidental or administrative data. These include scheduling records, communication logs, and internal working files. They have limited verification value and may be destroyed earlier than the research data. The matrix should mark them for routine deletion according to the institutional records schedule.

Building the Matrix Table

The matrix is a table with one row per data class. The columns are data class, format, sensitivity level, binding requirement, retention period, storage location, and destruction method. The table is completed at the start of the project and reviewed at each major milestone.

The sensitivity level column uses a simple scale. Level one is public or non-sensitive data. Level two is confidential data that requires access control. Level three is identifiable or sensitive data that requires encryption and restricted access. The sensitivity level determines the storage and destruction requirements for that class.

The binding requirement column records the source of the retention period. It may say funder, institution, journal, consent agreement, or law. This column is critical because it documents the reasoning behind the decision. When a reviewer or auditor asks why a particular class was kept for a particular period, the matrix provides the answer.

The storage location column assigns each class to a specific system. The destruction method column records how each class will be destroyed at the end of its period. The method must match the format and sensitivity. Paper records require shredding. Digital files on institutional servers require secure deletion. Physical media require physical destruction.

Using the Matrix During the Project

The matrix is not a static document. It is used at four points in the project lifecycle.

At the planning stage. The team completes the inventory and assigns provisional retention periods. The matrix is reviewed by the institutional research office or data steward before collection begins.

At the midpoint. The team reviews the matrix when the research design changes, when new data types are added, or when the funding agreement is modified. A change in the consent form or a new collaborator may require a new data class or a revised retention period.

At study closeout. The team verifies that the matrix matches the data that was actually collected. The team confirms that each class is stored in the assigned location and that the destruction schedule is accurate.

At the end of each retention period. The team uses the matrix to identify which classes are due for destruction. The destruction is performed according to the assigned method and documented in the project record.

Recording Matrix Decisions

The matrix itself is a record. It should be stored with the data management plan and versioned when it changes. Each version should note the date and the reason for the change. The version history provides evidence that the retention decisions were deliberate and reviewed.

The destruction log is a separate record. Each destruction event should include the date, the data class, the method, the person who performed the destruction, and the authorization for the destruction. The log should be retained even after the data is destroyed. The log is the evidence that the destruction was ethical and complete.

Common Matrix Failures

The matrix fails when it is treated as a formality instead of a working tool. The most common failure is completing the matrix at the start of the project and never reviewing it. The matrix becomes outdated when the research design changes and the team does not update it. The result is that data is destroyed according to a plan that no longer matches the actual data.

A second failure is assigning the same retention period to all classes. This happens when the team treats the matrix as a single row. The matrix only works when each class is evaluated separately.

A third failure is omitting the binding requirement column. Without this column, the matrix records a decision but not the reasoning. When the decision is questioned, the team cannot explain why a particular period was chosen.

A fourth failure is ignoring the destruction method column. The team assigns retention periods but does not plan for destruction. When the period ends, the team must improvise a destruction method, which increases the risk of incomplete or undocumented destruction.

Escalation Criteria for the Matrix

The matrix should trigger escalation when a data class cannot be assigned a retention period. This occurs when the binding requirement is unclear, when the consent agreement conflicts with the funder requirement, or when the data is subject to a legal hold. The researcher should escalate to the institutional research office, the data steward, or the legal office. The researcher should not guess. The data should be retained until the requirement is confirmed.

The matrix should also trigger escalation when a data class is assigned a retention period that exceeds the consent agreement. This conflict must be resolved before the data is collected, not after. The options are to revise the consent process, to de-identify the data, or to obtain a new authorization. The researcher should not proceed with collection until the conflict is resolved.

Integration with the Data Management Plan

The matrix is a working appendix to the data management plan. The plan describes the overall approach to data management, and the matrix provides the class-level detail. The plan should reference the matrix and state that the matrix is the authoritative record for retention decisions. The matrix should be submitted with the plan when the plan is reviewed, and it should be updated whenever the plan is updated.

For NIH-funded research, the data management and sharing plan must describe the preservation and sharing approach for the scientific data (NIH Data Management and Sharing Policy). The matrix supports this requirement by showing how each data class will be preserved, shared, or destroyed. The matrix also supports the transparency expectations of the EQUATOR Network by documenting the decisions that affect the availability of the data behind the reported results (EQUATOR Network).

Frequently Asked Questions

How long should I keep research data?

The retention period depends on the funder, the institution, and the data type. The period should be set in the data management plan before the study begins. For NIH-funded research, the data management and sharing plan must describe how the data will be preserved and shared (NIH Data Management and Sharing Policy). The researcher should verify the specific period with the institution and the funder.

What is the difference between storage and backup?

Storage is the primary location where the data is kept. Backup is a separate copy that can be restored if the primary copy is lost or corrupted. The backup should be in a different physical location and should be tested regularly. A backup that has never been tested is not a backup.

Can I store research data on my personal laptop?

Personal devices are not recommended for research data. The device may not be secured, encrypted, or backed up. The data may be lost or inaccessible when the researcher leaves the institution. The researcher should use the institutional repository or an approved storage system.

When should I destroy my research data?

Data should be destroyed when the retention period has ended and no funder, institutional, or legal requirement requires further retention. The researcher should verify that the period has ended before destroying the data. If there is any doubt, the data should be retained.

What is the difference between deletion and destruction?

Deletion removes the data from a visible location but may leave recoverable copies on the drive. Destruction makes the data unrecoverable. The destruction method must be appropriate to the data type and sensitivity. The destruction should be documented.

Do I need to keep data after my paper is published?

Yes. The data should be retained after publication to support verification and peer review. The Committee on Publication Ethics states that journals should expect authors to make data available if needed (Core Practices). The retention period should extend beyond the publication date.

What should I do if I am unsure about the retention period?

The researcher should escalate the question to the institutional research office, the data steward, or the funder. The researcher should not make a unilateral decision when the retention period is unclear. The data should be retained until the requirement is confirmed.

How should I document data destruction?

The destruction record should include the date, the method, the data that was destroyed, and the person who performed the destruction. The record should be retained as part of the project documentation. The record provides evidence that the data was handled responsibly.

Using the Evidence

Related Articles

• Ethical Data Collection in Research: Principles and Best Practices
• Ethical Issues in Data Collection: Navigating Privacy and Consent
• Ethical Considerations in Research with Vulnerable Populations: A Practical Guide
• Ethical Guidelines for Animal Research in Psychology: A Practical Overview
• Ethical Research Guidelines: Key Principles and How to Apply Them

References and Further Reading

• Research Methods Resources. National Library of Medicine.
• EQUATOR Network. EQUATOR Network.
• Core Practices. Committee on Publication Ethics.
• NIH Grants and Funding. National Institutes of Health.
• ORCID for Researchers. ORCID.
• Data Management and Sharing Policy. National Institutes of Health.
• NCBI Literature Resources. National Center for Biotechnology Information.
• PubMed. National Library of Medicine.

This article is educational and does not replace institutional policy, professional advice, or applicable safety and regulatory requirements.