This article is part of the Iris Ethics Knowledge Base; you can find a directory of all articles here.
Overview
Ethics approval does not end a researcher's data obligations. Research data must continue to be retained, stored, and eventually destroyed in line with the approved data management plan, applicable legislation, and institutional policy, for a period that runs beyond project completion. This is a separate obligation from Iris Ethics' own record-keeping requirements, covered below; the two should not be confused.
Researcher obligations: retaining project data
The National Statement does not set a fixed retention period for research data; the period is instead governed by the terms of the ethics approval, applicable legislation, and institutional policy. See Data sharing and retention for recommended retention periods and guidance on describing a retention approach in an application.
During the retention period, data must continue to be stored securely and in accordance with the approved data management plan, with access restricted to authorised individuals. Where data is moved to a new storage environment during the retention period, for example because of a system change, the same security requirements must be maintained in the new environment.
At the end of the retention period, data must be securely destroyed, meaning destroyed in a form that makes reconstruction impossible. Electronic data should be deleted using methods that prevent recovery; physical records should be shredded. Destruction should be documented. Using retained data for a purpose beyond the original approval, whether during or after the stated retention period, requires an amendment or a new application (see Amendments), since this changes the scope of what was approved.
Iris Ethics' own record retention
Separately, Iris Ethics retains its own records of an application, meaning the application file, approved documentation, decisions, and correspondence, for a minimum of 7 years after the completion of the project, in accordance with the Privacy Act 1988 (Cth) (Iris Ethics operating procedures, s.15). This is Iris Ethics' record-keeping obligation as the review body. It does not extend to, substitute for, or shorten the researcher's own obligation to retain and eventually destroy the project's research data, which is described above and remains the researcher's responsibility.
Related resources
This page was last updated on 16 September 2026.
Was this helpful? We'd appreciate your feedback!
This article makes reference to the National Statement on Ethical Conduct in Human Research 2025. It is intended as practical guidance and does not constitute legal advice.
AI Disclosure: Resources in this library were prepared using Large Language Models with input from Iris Ethics staff who guided the scope and design. Subsequent revisions and final versions were developed and approved by Iris Ethics staff.