"Three years" is the answer most people have heard, and it's not wrong. It's just the shortest of several answers, and the one that applies least often to the data you'd actually regret losing. The real question has two halves: what is the minimum you're required to keep, and what should you keep anyway because a reviewer, an auditor, a patent lawyer, or your own future paper might ask for it.
This guide walks through the rules that set a floor, the reasons to go past it, what "the data" even means for retention, and a short retention plan you can paste into a data management plan or a lab manual. It's written for U.S. federally funded research, with notes where your institution's policy or a specific regulation takes over. It isn't legal advice; your research office and IRB have the final word.
The federal floor: three years
For most federal grants, the baseline comes from the Uniform Guidance, the set of rules that govern federal awards. 2 CFR 200.334 says financial records, supporting documents, statistical records, and other records pertinent to a federal award must be kept for three years from the date the final financial report is submitted. NIH and NSF both point to this rule in their grant policy documents.
Three things about that sentence trip people up.
- The clock starts at closeout, not at the end of data collection. A five-year award with a final financial report filed in year six means data from year one is kept until at least year nine.
- "Records pertinent to the award" includes research data, not just receipts. The same regulation, at 200.315, is where the federal government reserves the right to obtain research data produced under an award, and you can't produce what you've deleted.
- The clock pauses if anything is open. An audit, a litigation hold, or a claim that starts before the three years are up extends retention until it's resolved.
So "three years" really means "at least three years after the grant is fully closed, longer if anyone is asking questions." For a typical award that works out to six to nine years after the first data point was collected.
Reasons to keep data longer
The floor is rarely the right target. Here are the deadlines that tend to push it out.
Research misconduct: six years
The Public Health Service misconduct regulation (42 CFR Part 93) applies a six-year limitation period: an allegation generally has to involve conduct within six years of the date the institution or HHS receives it, with exceptions for later use of the same work and for patterns of conduct. If an allegation arrives and the data are gone, the absence of records is itself a problem, because the regulation treats destruction of research records as something that can support a misconduct finding. This is why many institutional policies land on six or seven years rather than three, for any PHS-funded work and often for everything.
IRB and consent records: three years after the study ends
The Common Rule (45 CFR 46.115) requires IRB records, including signed consent forms, to be kept for at least three years after the research is completed. That's a separate clock from the grant clock, and for a study that ends after the award closes it can run later. Keep the consent forms with the data; you'll need them if you ever try to share the data, as the guide to consent language explains.
FDA-regulated studies: two years after approval, often much longer in practice
For clinical investigations of drugs, 21 CFR 312.62 requires investigators to keep records for two years after a marketing application is approved for the indication studied, or, if no application is filed or it's not approved, two years after the investigation is discontinued and FDA notified. Since you often don't control that trigger, sponsors typically ask for retention far beyond it. Follow the protocol and the sponsor agreement.
HIPAA documentation: six years
If your study runs under HIPAA (you're part of a covered entity and using protected health information), the Privacy Rule requires authorizations and other compliance documentation to be kept for six years from creation or last effective date. That's the paperwork, not the dataset itself, but in practice it means the authorization forms outlast the three-year grant floor.
Patents and intellectual property
If anything from the project could be patented, the lab notebooks, dated data files, and version history are the evidence of who invented what and when. Your technology transfer office will want them kept for the life of the patent and any dispute about it. Ask them before deleting anything from a project that produced an invention disclosure.
Your own future work
None of the above is the most common reason to need old data. The most common is that you, a co-author, or a student want to reanalyze it, answer a reviewer, build a follow-up study, or respond to a request after the paper is out. Journals increasingly expect a data availability statement, and a statement that says "available on request" is a promise that the data still exist.
Published data: indefinitely
Once a dataset is deposited in a repository with a DOI, retention stops being your problem in the practical sense: the repository's preservation policy takes over, and most commit to keeping deposits indefinitely or for a defined long period. This is the cleanest solution to the retention question for any data you can share. It also means a consent form that promises destruction after a set period has to be written carefully, since the shared copy won't be destroyed. The repository guide covers what to look for in a preservation commitment.
What "the data" means for retention
Retention rules talk about "research records," which is broader than a CSV. A practical reading: keep enough to reconstruct and defend what you published. That usually means the raw data as collected, the processed or analysis-ready dataset, the code or syntax that gets from one to the other, the codebook, the instruments and protocols, approvals and consent forms, and lab or field notes. The reproducibility guide is, in effect, a list of what to retain.
What you generally don't need to keep: scratch files, intermediate exports you can regenerate from code, duplicate copies on five laptops, and every draft figure. Retention isn't hoarding. A tidy project folder with a README is easier to keep for seven years than a 40 GB pile, and easier to hand to an auditor. The data organization guide shows the structure.
Retention versus destruction promises
Here's the conflict that catches the most people. The grant rules say keep the data; the consent form says "all data will be destroyed five years after the study ends." Both are binding.
The usual way out is to separate identifiers from content. Delete the key file, the signed forms (once their own retention period runs out), and anything that could readily identify a participant on the schedule you promised. Keep the de-identified dataset for as long as the funder and your institution require. Whether that reading is acceptable depends on exactly what the form said, so ask your IRB rather than assume. And for new studies, write the consent form so the promise is about identifiers, not about every copy of the data.
Who keeps it when people leave
Under most university policies, research data generated under a sponsored award belong to the institution, not the PI, because the institution is the legal recipient of the award and the party on the hook for retention. When a PI moves, the normal arrangement is that the institution keeps the original and the PI takes a copy under a written agreement; some policies allow transfer of the original with the sponsor's consent. Students and postdocs leaving a lab are the more frequent gap: their data lives on a personal laptop or in a personal cloud account that goes dark the week they leave. A lab-level rule that all project data lives in institutional storage, with the PI holding access, prevents most of this.
A retention plan you can actually follow
A retention plan doesn't need to be long. It needs to answer five questions and be stored somewhere the next person will find it.
- Retention period. State one number for the project and how it was chosen. Example: "Seven years after the final financial report, per [institution] policy, or longer if a hold is in place."
- What is retained. List the record types from the section above, and name the folder that holds them.
- Where. Institutional storage with backups, not a personal drive. Name the system and who holds the admin rights.
- Identifiers. When the key file and signed consent forms will be deleted, who does it, and how it's documented.
- Disposal. What happens at the end of the period: review, then either deposit, continued retention, or documented deletion. Deleting without a record is the only outcome to avoid.
Put the plan in the project README and in the data management plan. If your institution has a records retention schedule (most do, often managed by the library, archives, or compliance office), cite the entry that applies and use its number rather than inventing your own. [Placeholder: name your institution's data retention policy and the period it sets, if you want this section to speak to your own campus.]
If you support researchers
Retention is one of the questions a data services office hears most and documents least. A one-page campus guide that gives the local number, the list of what counts as a record, and the storage location would answer most of them. It belongs next to the DMP checklist, and it's a good second offering after DMP review for a library or research office that's just starting research data services. I help institutions build this kind of practical guidance; get in touch if that would be useful on your campus.
Common questions
How long does NIH require you to keep research data? For most NIH grants the floor comes from the federal Uniform Guidance: records must be kept for three years after the final financial report is submitted. Many institutions require longer, and the six-year window for research misconduct allegations is a common reason to keep data at least that long.
Does keeping data longer conflict with what I promised participants? It can. If the consent form says data will be destroyed after a set period, that promise applies to identifiable data. The usual fix is to delete identifiers on schedule and keep the de-identified dataset, and to write future consent forms so the two obligations don't collide.
What counts as research data for retention purposes? Enough to reconstruct and verify the published results: raw and processed data, the code or syntax, the codebook, instruments, consent forms, approvals, and lab or field notes. Scratch files and duplicate copies usually don't need to be kept.
Who is responsible for the data when the PI leaves the university? Usually the institution that received the award owns the data and remains responsible for retaining it, while the PI may take a copy under a written agreement. Check your institution's data retention and ownership policy before anyone moves.