Maintenance and Stewardship of Research Data
Frequently Asked Questions
Where can I receive assistance with my research using large secondary data sets?
Researchers should contact the Berkeley Research Data Management (RDM) program. Research data is broadly defined to include the digital inputs to and products of research performed in all campus disciplines. A partnership between Research IT and the Library, the RDM program offers consulting, training, and online guidance to address new requirements from funding agencies, publishers, and data providers, and to help researchers manage and steward their data effectively and efficiently.
How do I get information on confidential and secure data storage?
Please refer to our data security policy for guidelines on how identifiable information should be stored based on the storage device, location of the storage device, and who has access to the storage device.
How long should I keep my research records?
Research record retention length varies depending on sponsor, population, use of protected health information, federal regulations, and the Food and Drug Administration regulations when applicable, as detailed below. If more than one category applies, investigators should adhere to whichever retention period is longer.
In addition to these requirements, investigators are encouraged to include record retention flexibility language in their CPHS protocol and corresponding consent form(s) to allow for future data sharing and data use. For example, stating in the protocol and consent form(s) that data will be retained “indefinitely” and that collected data may be used for future research purposes by the investigators or by others creates flexibility for future data use/sharing.
| Record | Retention Period | Source |
|---|---|---|
| DHHS regulated research | Signed consent documents and research records must be retained for at least 3 years following the end of the study. | 45 CFR 46.115(b) 41 CFR 105-72.603 2 CFR 200.333 |
| HIPAA regulated research | Signed HIPAA authorizations must be retained for a minimum of
6 years after the completion of the study. An accounting of all disclosures of Protected Health Information (PHI) (not listed in the consent/authorization) must be retained for 6 years after the disclosure. | 45 CFR 164.530(j)(2) |
| FDA regulated research | Studies involving drugs: Signed consent documents and
research records must be retained for at least 2 years
following the date a marketing application is approved for the
drug for the indication for which it is being investigated;
or, if no application is to be filed or if the application is
not approved for such indication, until 2 years after the
investigation is discontinued and FDA is notified. Studies involving devices: Signed consent documents and research records must be retained for a period of 2 years after the latter of the following two dates: The date on which the investigation is terminated or completed, or the date that the records are no longer required for purposes of supporting a premarket approval application, a notice of completion of a product development protocol, a humanitarian device exemption application, a premarket notification submission, or a request or De Novo classification. | 21 CFR 312.62(c) 21 CFR 812.140(d) |
| Research subject to the Veterans Affairs (VA) | Retain records for 6 years after the end of the fiscal year in which the research project was completed. These records may be retained for longer than 6 years if required by other Federal regulations or the European General Data Protection regulations. | These records are considered Federal Records and are found in the Department of Veterans Affairs, Veterans Health Administration’s Records Control Schedule (RCS 10-1) |
| Sponsor Requirements | If a study is sponsored, investigators must ensure that they comply with any terms for record retention detailed in the corresponding contract. Prior to agreeing to a contract that specifies how long records will be maintained, investigators should ensure that they will receive adequate funding to pay for the required storage duration. | |
| Research Not Subject to the Above Categories | Best practice standards are to maintain research records for at least 3 years after completion (indefinitely is recommended). |
Should I keep data when a subject withdraws from research?
FDA-Regulated Research: FDA published a guidance document on requirements for retention of data by clinical investigators in studies regulated by FDA. The guidelines describe the FDA’s longstanding policy that already-accrued data, relating to individuals who cease participating in a study, are to be maintained as part of the study data. This pertains to data from individuals who decide to discontinue participation in a study, who are withdrawn by their legally authorized representative, as applicable, or who are discontinued from participation by the clinical investigator.
When a subject withdraws from a study, the researcher may ask the withdrawing subject to allow the researcher to obtain follow-up data through non-invasive means such as chart review. In this case, the investigator may continue to obtain data as agreed by the subject.
If the subject does not agree to continued follow-up, then the investigator must not access the subject’s records for purposes of the research study once the subject has withdrawn. The investigator may, however, review data already collected and may review publicly available records to obtain data on the subject (e.g., for survival status).
DHHS-Regulated Research: The U.S. Department of Health and Human Services (DHHS) issued its own guidance on data retention when subjects withdraw from a study, which differs from FDA’s guidance. DHHS states that when a subject withdraws from a study, the investigator may honor the subject’s wishes to remove all data collected from the study database. As a best practice, investigators should follow these guidelines for all other non-FDA regulated research.
How do I close my protocol?
Regardless of how long you intend to keep your research records, your eProtocol application should be closed after data collection and data analysis (if retaining personally identifiable information) are complete. Please see Close an Approved Protocol for instructions on how to submit a closure request in eProtocol.
Related information
- Data Security
- UC Office of the President: Administrative Records Relating to Research: Retention and Disposition Requirements