Data Protection & Freedom of Information Office

Retention of Research Data

Research data is subject to a specific and limited exemption from the requirements of the GDPR. Unlike other processing of personal data, personal data for research use may, in some circumstances, be retained indefinitely. Researchers must determine the retention requirements for their research data and records on a project by project basis, or at least for clearly defined categories of projects, taking into account:

• The legal and regulatory framework for particular types of research;

• The terms and conditions imposed by external research sponsors;

• The commercial, political or ethical sensitivity of particular types of research, or any research for particular external sponsors.

The Research Strategy & Innovation Office's publication Good Practice in Research, available as part of the Research Integrity Framework, provides recommendations on documenting results and storing primary data based on the requirements of several Research Councils. 

The Research Data Management team is responsible for the storage and maintenance of research data. More information about this services is found on their website.

Please note: the term "research" is not precisely defined by the GDPR, but it includes historical and statistical studies. The rules concerning research on personal data are covered in the Research  and Research Checklist entries of this A to Z guide.