Â鶹ÊÓƵ

Introduction

The Archives and Records Management (ARMD), in consultation with Â鶹ÊÓƵLibrary's Data Services Team, has created these guidelines to support Â鶹ÊÓƵresearchers in developing a customized data retention schedule for their research data containing the personal information of EU residents, subject to the General Data Protection Regulation (GDPR), received, collected, created, and used by Â鶹ÊÓƵfaculty for the purposes of conducting research. 

The Research Ethics Board (REB) was consulted on the production of this guideline and provided advice in relation to those projects that are deemed to be research involving human participants and are subject to oversight by the REB and where the research data concerned contains the personal information of EU residents and is subject to the General Data Protection Regulation (GDPR). 

REMINDER: Human research projects must ensure data retention complies with all legal, regulatory and policy requirements applicable to human research; importantly, the Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans (TCPS2). 

What is research data?

Research data are data that are used as primary sources to support technical or scientific enquiry, research, scholarship, or creative practice, and that are used as evidence in the research process and/or are commonly accepted in the research community as necessary to validate research findings and results.

What is research data management (RDM)?

Research data management (RDM) describes all activities that support the responsible collection, handling, storage, organization, documentation, sharing, publication, and long-term storage of all types of research data created, collected, and used during a research project. 

What is a data management plan (DMP)?

A data management plan (DMP) is a document that outlines how data will be managed throughout a research project. Developing a DMP is a vital part of the research process, and ensures research data are accurate, complete, reliable, accessible, and secure both during and after the conclusion of a research project.

What is a data retention schedule?

A data retention schedule is a set of guidelines researchers should develop as part of a DMP that dictates how long, and in what manner, research data is retained. A data retention schedule should describe the data, define a retention period for each type of data, and identify the final disposition of each type of data (either confidential destruction or preservation in a repository/archives). Researchers should take responsibility for articulating their plans for data retention when building a DMP.

What is the difference between data retention and data deposit?

Data deposit is the process of transferring research data to a dedicated data repository or archives to manage storage, preservation, and publication of data files. This is one method of managing data retention for a research project. However, data deposited in a research repository or archives is typically only a subset of data created during a research project. A data retention schedule is broader and describes data retention for all data created during a research project.

Retention Considerations

Instead of prescribing pre-determined retention periods, this guideline is designed to assist researchers in establishing a data retention schedule based on an analysis of applicable legislation, contractual obligations, and requirements of funding bodies.

Retention Consideration 1: Applicable Legislation

Research data may be subject to legislation. Researchers should be mindful of the legislative landscape in which they are working and identify any retention requirements derived from applicable laws or regulations.

Example 1: As per Part C, Division 5, subsection C.05.012(4) of the Food and Drug Regulations C.R.C., c870, Health Canada Regulated Clinical trial data should be retained for a minimum of 15 years from the date when the records were created.

Example 2: The General Data Protection Regulation (GDPR) requires that personal information of EU residents be kept no longer than necessary to fulfill the purpose for which it was originally collected. As more Â鶹ÊÓƵresearchers seek out European funding, they may be required to demonstrate how their research retention practices are GDPR compliant. Having a DMP in place which includes a detailed data retention schedule will help demonstrate GDPR compliance.

While research data often falls outside of the jurisdiction of British Columbia’s Freedom of Information and Protection of Privacy Act (FIPPA), and the Federal Government’s Privacy Act (PA), researchers are encouraged to consult with the Research Ethics Board to determine if there are additional privacy considerations that need to be addressed. 

Retention Consideration 2: Contractual Obligations

In some cases, researchers may have contractual obligations to 3rd parties (e.g., information sharing agreements with private companies or health bodies). In this case, data retention requirements may be specified in the contract (i.e., how long data should be retained, if/when data should be published, etc.).

Retention Consideration 3: Requirements of funding bodies

In Canada, the Tri-agencies have encouraged data management through the , the , the , CIHR’s , SSHRC’s , and data sharing provisions for CIHR grant holders in the .

RDM is an evolving area, and funding body requirements are subject to change. Note, most funding bodies do not specify a specific period for data retention but instead encourage researchers to deposit data as soon as possible. The table below lists suggested records retention periods based on type of funder for research projects. Note that the table below is not intended to be an exhaustive list. 

Final Considerations

If your research falls outside of the framework described above (e.g., does not have retention requirements tied directly to legislation, publishers, or funding bodies), then use the table below to help determine a retention period. Note, at the time of drafting this guidance, no Canadian funding body had issued recommendations on retention of research data outside of the citations above. As additional guidance is issued, this guideline will be updated. For now, the retention guidance listed in the table below is derived from generally accepted best practices. 

Calculating a retention period

To calculate a data retention period researchers should review and document all applicable data retention requirements from the considerations listed above including the:

• minimum legislative requirements for data retention;
• maximum legislative requirements for data retention;
• minimum contractual obligations for data retention;
• maximum contractual obligations for data retention;
• minimum funding body requirements for data retention; and 
• maximum funding body requirements for data retention.

Researchers should then conduct an analysis to determine which data retention considerations are most relevant when establishing a data retention policy.

Examples of calculating a retention period

• Researcher A is funded by NIH (US federal government grant). They use publicly available information for their research. As per an approved data management plan, they must retain the information for a minimum of 3 years but may retain it for up to a maximum of 10 years unless deposited in a research repository or archives for permanent preservation.

• Researcher B conducts a clinical trial regulated by Health Canada. They gather indirectly identifying information which they de-identify as soon as their initial analysis is complete. They must retain their identified information for a minimum of 15 years from the date when the records were first created. They should consider depositing their de-identified data in a research data repository or archives. However, they should destroy the identifiers as soon as possible to protect the privacy of the individuals involved in the clinical trial unless there is a legitimate interest in retaining such identifiers.

Options for Archiving Research Data

Â鶹ÊÓƵresearchers are encouraged to consider depositing their research data with Â鶹ÊÓƵResearch Data Collection at Federated Research Data Repository (FRDR) (contact data services@sfu.ca) or the University Archives and Records Management Department (ARMD) (contact archives@sfu.ca) for permanent preservation.

Researchers are encouraged to contact repositories as early as possible in the research cycle, to discuss data preservation options and appraisal criteria (i.e., what to keep, what to destroy) to ensure deposit data meets repository requirements.

Definitions

The definitions below are taken from

• Anonymized information – the information is irrevocably stripped of direct identifiers, a code is not kept to allow future re-linkage, and risk of re-identification of individuals from the remaining indirect identifiers is low or very low.

• Coded information – direct identifiers are removed from the information and replaced with a code. Depending on access to the code, it may be possible to re-identify specific participants (e.g., the principal investigator retains a list that links the participants' code names with their actual names so data can be re- linked if necessary).

• Directly identifying information – the information identifies a specific individual through direct identifiers (e.g., name, social insurance number, personal health number).

• Indirectly identifying information – the information can reasonably be expected to identify an individual through a combination of indirect identifiers (e.g., date of birth, place of residence, or unique personal characteristic).