Good Practice for 25-Year Retention of GxP Data

Records spread across old systems, file shares, and multiple vendors increase risk and cost. Long-term records should be moved into controlled, validated archive systems.

Good practice includes:

• Moving records that require long-term retention into validated archive platforms
• Retiring old systems once data is safely preserved
• Reducing the number of archive systems where possible
• Keeping data, metadata, audit trails, and signatures together

Why this matters: It reduces complexity, lowers risk, and improves oversight.

Archived data must remain intact and unchanged for decades. It should be monitored and checked regularly.

Good practice includes:

• Keeping more than one independent copy
• Running regular integrity (checksum) checks
• Testing backups by restoring data
• Replacing ageing hardware before failure
• Investigating and documenting any issues

Why this matters: It prevents silent corruption, accidental deletion, and long-term damage.

Old or proprietary file formats may not open in the future. Choosing stable formats reduces this risk.

Good practice includes:

• Using PDF/A for documents
• Using CSV, JSON, or XML for structured data
• Using TIFF or PNG for images

Why this matters: It improves long-term accessibility and reduces reliance on specific software.

Metadata, system logs, and audit trails may form part of the essential trial record. They must be kept together with the main content where needed to understand the trial.

Good practice includes:

• Exporting audit logs in usable formats
• Retaining metadata, version history, and electronic signatures
• Checking integrity after migrations

Why this matters: It ensures records remain complete and defensible during inspection.

Over 25 years, vendors may change ownership, pricing, or stop operating. Systems may also be replaced.

Good practice includes:

• Securing rights to full data exports in contracts
• Testing retrieval and restore processes
• Having clear migration or system retirement plans
• Considering escrow or continuity arrangements for critical systems

Why this matters: It protects long-term access to records.

Long retention periods increase the risk of confusion about who owns and manages records. Responsibilities must be clearly assigned.

Good practice includes:

• Naming accountable record owners
• Defining custody transfer processes
• Reviewing archive health and inspection readiness periodically

Why this matters: It prevents gaps in responsibility and protects chain of custody.

Trial records often contain personal and confidential information. They must remain protected while still being accessible to regulators when required.

Good practice includes:

• Applying role-based access controls
• Managing encryption keys over the long term
• Keeping documented legal justification for retention and access

Why this matters: It protects participants while maintaining compliance.

Retention over decades requires ongoing funding and oversight. It should not be treated as a one-time activity.

Good practice includes:

• Including retention costs in trial budgets from the start
• Planning for ongoing preservation activities
• Choosing archive solutions designed for long-term use

Why this matters: It avoids underfunded archives becoming compliance risks.