The database is only one of the things a trial has to keep. FDA, ICH GCP, the EU Clinical Trials Regulation and national rules each set their own clock, and the longest one usually wins. This guide lays the clocks side by side and ends with an archive package you can build before the last visit.
Free sandbox · No credit card · 21 CFR Part 11 aligned
| Trigger | Typical minimum | |
|---|---|---|
| FDA IND investigator records (21 CFR 312.62) | Marketing approval, or discontinuation plus FDA notice | 2 years after |
| IRB records (21 CFR 56.115) | Completion of the research | 3 years after |
| EU CTR Art 58 (trial master file) | End of the clinical trial | 25 years |
| UK trials (MHRA guidance) | Conclusion of the trial | 25 years |
| Your sponsor contract | Often longer than the regulation | Check the agreement |
Retention in one page
The problem
Most small sponsors and academic teams treat archiving as the last task on the close-out list: lock the database, export a file, put it somewhere. The trouble is that the retention obligation can outlast the study team, the sponsor entity and the software contract by decades. A university spin-out that dissolves, a PI who moves institutions or an EDC subscription that lapses can each leave a trial with data nobody can open or authenticate when an inspector asks for it.
Thinking about archiving at study set-up changes what you do early. You choose a data system whose exports include a data dictionary, you keep the audit trail in a form you can hand over, you name a person responsible for the archive, and you write down which copy of each record is the master. It also changes budgets: long-term storage, access control and periodic readability checks are real, recurring costs that belong in the plan, not in a surprise invoice. Our guide to audit-ready clinical trial data covers the inspection side of the same problem, and clinical trial data ownership and portability covers getting data out of any system.
The clocks
Periods below are summarized from the regulation or guideline named in each row and from secondary sources. They are shown so you know what to look up, not as a substitute for reading the current text. Verify the wording before you rely on it.
| Source | Who it binds | Retention period (summary) | Notes and hedges |
|---|---|---|---|
| 21 CFR 312.62(c) | Investigators on a US IND | 2 years after a marketing application is approved for the indication; if none is filed or approved, 2 years after the investigation is discontinued and FDA is notified | FDA warning letters apply this to clinical investigators. Institutions often add longer periods. |
| 21 CFR 312.57(c) | Sponsors of a US IND | Same structure as above for sponsor records | Stated from general knowledge of the rule; check the current eCFR text. |
| 21 CFR 812.140(d) | Sponsors and investigators in device investigations (IDE) | 2 years after the later of termination or completion of the investigation, or when records are no longer needed to support a premarket submission | The "no longer needed" trigger can push the date well past study end. |
| 21 CFR 56.115 | IRBs | At least 3 years after completion of the research | Applies to IRB records, not investigator records; often confused with the IND rule. |
| ICH E6(R2) essential documents | Sponsors and investigators following GCP | Widely quoted as 2 years after the last marketing approval in an ICH region and none pending, or 2 years after formal discontinuation of development | The formulation appears in many protocols; check the section in the guideline itself. |
| ICH E6(R3) | Sponsors and investigators following GCP | Secondary sources say it no longer fixes a number: keep records for the period set by applicable regulation, or until the sponsor says they are no longer needed, whichever is longest | Verify against the adopted text. Adopted January 2025; EU application reported from 23 July 2025. |
| EU Clinical Trials Regulation 536/2014, Art 58 | Sponsors and investigators in EU trials | Archive the content of the clinical trial master file for at least 25 years after the end of the trial, unless other EU law requires longer | Subject medical files follow national law. Named archive owners, restricted access and legible media are also required. |
| UK (MHRA guidance, Regulation 31A) | Sponsors, investigators and delegates in UK trials | At least 25 years from the conclusion of the trial for trial master file documents and participant medical files, or longer where needed for marketing authorisation | Check MHRA after the 2026 amendments to the UK regulations. |
| Your sponsor or funder agreement | Whoever signed it | Often "until notified" or a fixed long period | Can exceed every regulation. Read the clause before you destroy anything. |
This table is a research aid and not legal advice. For anything you will act on, open the current regulation text and confirm with your regulatory adviser or QA.
The scope
Retention rules usually speak of "essential records" or the "trial master file", not of "the data". In practice that covers two overlapping groups. The first is the study data and everything that proves where it came from: case report form data, the audit trail of every change, query history, signed consent forms, source documents, randomization and unblinding records, laboratory ranges and imaging reads. The second is the evidence that the trial was run properly: protocol and amendments, approvals, delegation logs, monitoring reports, deviation logs, safety reports and the validation records for the computerised systems used.
Each group has a different home. Site-held documents sit in the investigator site file. Sponsor documents sit in the trial master file. The EDC holds the data and its audit trail. If you use a separate eTMF, EDC and eTMF explains how the roles divide. For a lean team, a short investigator site file index is a practical way to see what is where.
The EU regulation separates the trial master file from the medical files of participants, which are archived under national law. A participant's hospital record is not the sponsor's to keep, and the sponsor's case report form data is not the hospital's. When you design the archive, be clear about whose record is whose, and keep the link between them (participant code to identity) under the access controls your consent form promised.
A binary dump that only the original software can open is a risk. The EMA guideline on computerised systems and electronic data in clinical trials covers archiving and decommissioning of systems, and the EU regulation expects content to stay complete and legible. Prefer open, self-describing formats: CSV or Excel with a data dictionary, PDF for forms and signed documents, and standard datasets where your statistician uses them. See our EMA computerised systems guideline guide for the broader expectations.
GDPR limits how long identifiable personal data is kept, while clinical trial rules require long retention. The usual resolution is to keep identifiers separate from coded data, restrict who can reach them and document the legal basis and the retention period in the privacy notice and consent form. Rules for research differ by country, so take advice from your data protection officer. Our GDPR-compliant clinical trial software page covers hosting and roles, and HIPAA versus GDPR compares the two regimes.
What the platform gives you
Capture is the data system for the live study. It is not an archive service, but several of its behaviours make a clean archive easier to build and defend.
Study
DEMO-ARCH-02
Lock date
2026-11-20
Copies
2 locations
Build a small study in the free sandbox, enter practice data and download the CSV, data dictionary and audit trail. If your archive plan cannot use those files, you find out now, not at database lock.
The plan
A one-page plan agreed at set-up is worth more than a perfect archive designed after the last visit.
Data, audit trail, queries, consent, source, essential documents, validation evidence, safety and monitoring records. Note who holds each.
For each country and regulator involved, look up the rule, then add the sponsor contract and funder terms. Record the longest period per record type.
Many periods start at end of trial, approval or discontinuation, not at database lock. Write down which event starts the clock and who tells the sites when it has happened.
Open formats, two independent copies, access limited to named people. Decide how readability will be checked and how often.
A role, not a person who will leave. Write down what happens to the archive if the sponsor entity is sold, merged or wound up.
State how long data will be kept and why, consistent with GDPR or local rules, and tell participants how to reach the data controller.
Set a review date. Destroy only on written sponsor release, document the destruction and keep that record.
Close-out
Adapt to your protocol and contract. These are the items inspectors most often ask to see.
Export after database lock; record the lock date and who approved it. See database lock.
Keep the codebook and the blank eCRF PDF for the final version of every form.
Export the full change history, including query and signature events, and store it with a hash or checksum record.
One signed document per participant, including superseded versions, with timestamps.
Allocation list, unblinding events and who had access, kept under restricted access.
Analysis datasets, programs, outputs and the version of the data they were run on.
UAT records, user lists, access reviews and any change log for the computerised system.
Protocol and amendments, approvals, delegation logs, monitoring and deviation records, safety reports.
Who can open it, who approved them and when access is reviewed.
The written trigger and approver for ending retention, and a log of anything destroyed.
Be clear about the boundary
Capture is hosted in the EU (Frankfurt) or the USA (N. Virginia) and keeps the data of a live study, with a field-level audit trail, role-based access and soft-delete-only handling of clinical data. It does not offer a long-term archive or escrow service, and this page does not claim one. The period for which a study database is kept after a subscription ends is a matter for your agreement, so ask for it in writing before you rely on it.
The practical advice is therefore simple: take your own exports at close-out, store them under your own retention plan, and keep them in formats you can read without Capture. Capture's job is to make those exports complete and the history trustworthy. Yours is to keep them for as long as the longest clock requires. Capture provides 21 CFR Part 11-aligned controls; validated use and the archive are shared responsibilities with the sponsor. See the 21 CFR Part 11 compliance checklist for the system side.
It depends on the regulator and the contract. US IND rules count years after approval or discontinuation, the EU Clinical Trials Regulation requires at least 25 years after the end of the trial for the master file, and the UK guidance also cites 25 years. Keep records for the longest applicable period and confirm with your regulatory adviser.
The regulation says subject medical files are archived under national law, so the 25-year trial master file rule does not by itself govern them. UK guidance treats medical files differently. Check the rule of each country where you recruit.
Secondary sources report that it no longer states a fixed period and instead points to applicable regulatory requirements or the sponsor's notice, whichever is longest. Read the adopted guideline text to confirm.
Treat it as part of the record you are required to keep and be able to produce. Do not destroy it before the retention period ends and the sponsor has released the records in writing.
No. Capture does not offer a long-term archive or escrow service. You can export CSV or Excel with a data dictionary, SDTM datasets, the audit trail, a blank eCRF PDF and signed consent PDFs, and keep them under your own plan. Ask about post-contract data handling in writing.
Clinical data is soft-deleted only; hard deletes are blocked by a database trigger, and the change stays in the audit trail.
No. It is a summary to help you find the right sources. Check current regulation texts and take advice for your situation.
Keep exploring
Audit-ready clinical trial data
Inspection readiness.
Audit trail export for inspectors
Hand-over of the history.
Clinical trial data ownership and portability
Getting data out.
Database lock
The step before archiving.
SDTM export software
Standard datasets.
EU CTR clinical trial software
The 25-year rule context.
ALCOA+ data integrity checklist
Record quality.
EDC go-live checklist
Plan archive exports before launch.
Free sandbox with every feature. No credit card, and you pay only when you go live with real participants.