How long records should be kept

Every record in a quality system has to be kept for a defined period and then, in most cases, disposed of in a controlled way. Keeping everything forever is not a policy: storage fills, formats age, and a record no one can find is not much better than one that was thrown away. Keeping too little is worse, because a question about a batch can arrive long after the batch was made. Retention periods exist to settle in advance how long each kind of record must survive.

Where the periods come from

There is no single number that applies everywhere. The period for a given record is set by whichever of three things demands the longest: the regulation that applies to the work, the life of the material the record describes, and any contract or agreement that covers it.

For manufacturing records, the regulations tie retention to the batch rather than to the date the record was made. In the United States, 21 CFR Part 211 requires production, control and distribution records for a batch to be kept for at least one year after the batch’s expiration date. Chapter 4 of the EU GMP guidelines requires batch documentation to be kept for at least one year after the batch expires or at least five years after it was certified for release, whichever is longer. ICH Q7, which covers active ingredients, sets at least one year after expiry, and for materials that carry a retest date instead of an expiry date, at least three years after the batch has been completely distributed.

Some records outlast any single batch. EU GMP expects documentation that supports a marketing authorization, such as validation and stability data, to be kept for as long as that authorization is in force. Records of equipment qualification, method validation and staff training are needed for as long as the equipment, method or person is in use, and for a period afterward, because they support every result produced in that time.

Laboratory standards take a different approach. ISO/IEC 17025 does not set a retention period. It requires an accredited laboratory to define its own, and to control how records are identified, stored, protected, backed up, archived, retrieved and disposed of. The period a laboratory chooses usually reflects what its customers’ regulations require, because a test report is only useful if its supporting data still exists when someone asks about it.

Contracts and quality agreements often set periods longer than the regulatory minimum. Where a laboratory or manufacturer works for a client, the agreement should say who keeps which records, for how long, and what happens to them if the relationship ends.

When the clock starts

Retention periods are usually counted from an event, not from the date of creation. For batch records it is the batch’s expiry date or its certification for release. For a material with no expiry date, it may be the date the last of the batch was distributed or used. For a validation report, it is the date the method or equipment was retired. A retention schedule that lists only durations, without stating the event each one runs from, will be applied inconsistently by the people who use it.

Keeping records usable

A record kept for its full period still has to be readable at the end of it. Paper needs storage that protects it from damp, heat, pests and light, and thermal printouts fade within a few years unless they are copied. A verified true copy, made and checked under a procedure, can stand in for a fading original. Electronic records need more active care. File formats become obsolete, storage media fail, and the software that interpreted the data may no longer run. The data integrity expectation that a record be enduring and available means the data and its metadata, including the audit trail, must remain retrievable in a form a reviewer can understand. 21 CFR Part 11 requires audit trail documentation to be kept for at least as long as the records it describes.

Archives should be tested from time to time by retrieving a sample of old records and confirming they can still be read. A backup that has never been restored is an assumption, not a record.

Disposal

When a record reaches the end of its retention period, it should be disposed of under a procedure, with a log of what was destroyed and when, approved by someone with the authority to do so. Records connected to an open investigation, complaint, legal matter or inspection are held until that matter closes, whatever the schedule says. Where the rules of more than one jurisdiction apply, the longest applicable period governs, and the controlling regulation for each market is the final word on what that period is.