"How long do we have to keep this?" is one of the most common questions a compliance team asks, and it's also one of the most commonly answered wrong. People reach for 21 CFR Part 11 record retention as if Part 11 itself sets the clock. It doesn't. Part 11 tells you how an electronic record has to be protected and reproduced. It's the predicate rule sitting underneath it, GMP, GLP, GCP, or an EU regulation, that actually sets the number of years.
That distinction matters because the retention periods aren't the same across disciplines, and getting the wrong one wrong can mean destroying a record FDA or EMA still expects to exist. This guide walks through what Part 11 actually says about retention, the specific periods set by GMP, GLP, and GCP/IND regulations, and the EU Clinical Trials Regulation's 25-year trial master file requirement, with direct quotes from each regulation rather than a rounded-off summary.
Key Takeaways
- 21 CFR Part 11 doesn't set its own retention period. Section 11.10(c) requires "protection of records to enable their accurate and ready retrieval throughout the records retention period," a period defined elsewhere, by the predicate rule that required the record in the first place.
- GMP batch records under 21 CFR 211.180(a) must be kept "for at least 1 year after the expiration date of the batch," or 3 years after distribution for certain exempt OTC products without expiration dating.
- GLP study records under 21 CFR 58.195(b) follow whichever of three periods is shortest: 2 years after a related marketing application is approved, 5 years after study results are submitted to FDA, or 2 years after the study is completed, terminated, or discontinued. Critically, 58.195(a) says these periods "do not supersede the record retention requirements of any other regulations in this chapter," so the shortest period settles Part 58 only, never the whole obligation.
- GCP/IND records split by role: sponsors retain records under 21 CFR 312.57(c) for 2 years after marketing approval (or 2 years after investigational use is discontinued), and investigators retain records under 21 CFR 312.62(c) on the same 2-year structure.
- The EU Clinical Trials Regulation sets the longest period in this comparison: Article 58 of Regulation (EU) No 536/2014 requires the sponsor and investigator to "archive the content of the clinical trial master file for at least 25 years after the end of the clinical trial."
Part 11 Doesn't Set a Retention Period. It Protects the Record for Whatever Period Applies.
This is the piece that trips people up most often, and it's worth being precise about it because Part 11 record retention gets treated as its own standalone number when it isn't one. 21 CFR 11.10(c) requires "protection of records to enable their accurate and ready retrieval throughout the records retention period." Read that sentence closely: it assumes a retention period already exists, set by something else, and tells you your system has to keep the record retrievable for the full length of it.
11.10(e) is subtly different, and the difference matters. It requires that "such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying." That is not merely a protection requirement pointing at someone else's clock. Most predicate rules never mention audit trails at all, so for that one record class Part 11 does create a retention obligation of its own, and then defines its length by reference to the underlying record. The number still comes from the predicate rule, but the obligation to keep the audit trail that long comes from Part 11.
Neither section names a number of years. Part 11 is a controls regulation, not a records-schedule regulation. The actual retention clock comes from the predicate rule, the underlying regulation that required the record to exist in the first place, which is the same relationship we cover in detail in our guide to Part 11 applicability and predicate rules. For records governed by GMP, that's 21 CFR Part 211. For nonclinical safety studies, it's 21 CFR Part 58. For IND-stage clinical records, it's 21 CFR Part 312. Each one sets a different number, and they run from different trigger events, so working out which clock applies to a given record is a regulatory assessment, not a system setting.
GMP Batch Records: At Least One Year Past Expiration
21 CFR 211.180(a) is direct about this one: "Any production, control, or distribution record that is required to be maintained in compliance with this part and is specifically associated with a batch of a drug product shall be retained for at least 1 year after the expiration date of the batch or, in the case of certain OTC drug products lacking expiration dating because they meet the criteria for exemption under § 211.137, 3 years after distribution of the batch."
That's the regulatory floor, one year past expiration for most batches, three years past distribution for the narrow OTC exemption case. In practice, most manufacturers retain GMP batch records well beyond that floor for internal quality and litigation-risk reasons, but the one-year figure is the actual Part 211 requirement. It's the same regulatory backbone behind the batch record signature and audit trail obligations we cover in our guide to e-signatures for pharmaceutical QA.
Two neighboring paragraphs matter as much as (a) and are routinely missed. 211.180(b) sets a separate clock for components, drug product containers, closures, and labeling, running to at least 1 year after the expiration date or, for the same OTC exemption case, "3 years after distribution of the last lot of drug product incorporating the component or using the container, closure, or labeling." For a common excipient used across many lots, that is a materially longer obligation than any single batch record, and a schedule built only from (a) will under-retain it. 211.180(c) then supplies the sentence that makes an electronic archive legally sufficient for inspection: "Records that can be immediately retrieved from another location by computer or other electronic means shall be considered as meeting the requirements of this paragraph." 211.180(d) permits true copies rather than originals.
GLP Study Records: Three Possible Clocks, and the Shortest One Governs Within Part 58
Nonclinical laboratory studies under Good Laboratory Practice regulations follow a more structured rule. 21 CFR 58.195(b) states that documentation, raw data, and specimens "shall be retained in the archive(s) for whichever of the following periods is shortest":
- At least 2 years following the date a related research or marketing permit application is approved by FDA, for studies that support that application (this category specifically excludes IND and IDE submissions, which fall under the next bullet).
- At least 5 years following the date the study results are submitted to FDA in support of a research or marketing permit application, including IND and IDE submissions.
- At least 2 years following the date the study is completed, terminated, or discontinued, in other situations, the regulation's example being a study that never results in a submission supporting a research or marketing permit application.
The "whichever is shortest" framing is unusual next to GMP's flat floor, and it's easy to misapply if you assume GLP retention works the same way as batch record retention. It doesn't. A study's actual regulatory floor depends on which of those three scenarios it falls into, which is why the retention schedule for a nonclinical toxicology study has to be evaluated against its own submission history, not against a single fixed number.
"Shortest" applies only inside Part 58. This is the single easiest way to destroy a record too early. 21 CFR 58.195(a) opens the section by stating that "record retention requirements set forth in this section do not supersede the record retention requirements of any other regulations in this chapter." The shortest-of-three rule resolves which period applies under Part 58. It does not license destroying a record that some other regulation in Chapter I still requires you to keep. A toxicology report that satisfies 58.195(b)(1) two years after approval may still be held by the sponsor's obligations under Part 312 or by NDA-holder requirements covering the same document. Clear the shortest Part 58 clock, then check every other rule that reaches the same record before anything is destroyed.
GCP/IND Records: Two Years, Split Between Sponsor and Investigator
Clinical investigation records under Part 312 use the same two-year structure on both the sponsor and the investigator side, though each is governed by its own section. 21 CFR 312.57(c) requires a sponsor to "retain the records and reports required by this part for 2 years after a marketing application is approved for the drug; or, if an application is not approved for the drug, until 2 years after shipment and delivery of the drug for investigational use is discontinued and FDA has been so notified."
21 CFR 312.62(c) mirrors that structure for investigators: "An investigator shall retain records required to be maintained under this part for a period of 2 years following the date a marketing application is approved for the drug for the indication for which it is being investigated; or, if no application is to be filed or if the application is not approved for such indication, until 2 years after the investigation is discontinued and FDA is notified." Both sections tie the retention clock to the same triggers, approval or discontinuation with notice to FDA, applied separately to whichever role holds the record. Site-level obligations under this structure are the same ones we walk through in Part 11 for small clinical research sites.
EU CTR 536/2014: 25 Years for the Trial Master File
The EU Clinical Trials Regulation sets a retention period an order of magnitude longer than anything on the FDA side. Article 58 of Regulation (EU) No 536/2014 requires that "the sponsor and the investigator shall archive the content of the clinical trial master file for at least 25 years after the end of the clinical trial." The same article requires the sponsor to "appoint individuals within its organisation to be responsible for archives," and requires that the archived content remain "readily available and accessible, upon request, to the competent authorities," with any alteration to the file's content traceable. One clause later the same article carves out a major exception: "However, the medical files of subjects shall be archived in accordance with national law." Subject medical records are not on the 25-year clock. They follow the law of the member state, which varies, so a site cannot apply the TMF period to its patient files and assume it is covered. We cover the full scope of the regulation, including CTIS submission and archive-owner designation, in our guide to EU Clinical Trial Regulation 536/2014.
That 25-year figure applies specifically to the trial master file for trials in scope of the EU CTR. It doesn't retroactively extend to a US-only IND study, and it doesn't substitute for the shorter GMP or GLP retention periods on records that fall under those regulations instead. A sponsor running trials across both jurisdictions needs to recognize that the EU trial's TMF carries the longest obligation in its entire recordkeeping program by a wide margin.
Retention Periods at a Glance
| Record type | Regulation | Retention period |
|---|---|---|
| GMP batch records | 21 CFR 211.180(a) | 1 year past expiration (3 years past distribution for exempt OTC) |
| GMP component, container, closure, labeling records | 21 CFR 211.180(b) | 1 year past expiration, or 3 years past distribution of the last lot using it (exempt OTC) |
| GLP nonclinical study records | 21 CFR 58.195(b) | Shortest of: 2 years post-approval, 5 years post-submission, or 2 years post-completion. Does not supersede longer clocks elsewhere (58.195(a)) |
| Sponsor IND records | 21 CFR 312.57(c) | 2 years post-approval or post-discontinuation and FDA notification |
| Investigator IND records | 21 CFR 312.62(c) | 2 years post-approval or post-discontinuation and FDA notification |
| EU trial master file | EU CTR 536/2014, Article 58 | At least 25 years after trial end |
FDA Has Said This Itself Since 2003
The predicate-rule framing above is not an interpretation. It is FDA's published position. The agency's August 2003 guidance for industry on the scope and application of Part 11 states that "we do not intend to take enforcement action to enforce compliance with the validation, audit trail, record retention, and record copying requirements of part 11 as explained in this guidance. However, records must still be maintained or submitted in accordance with the underlying predicate rules, and the Agency can take regulatory action for noncompliance with such predicate rules." The guidance is explicit that "part 11 remains in effect" and that the discretion "applies only as identified in this guidance."
Section III.C.5 applies that discretion to retention by name, covering "the part 11 requirements for the protection of records to enable their accurate and ready retrieval throughout the records retention period (§ 11.10 (c) and any corresponding requirement in §11.30)," and then states plainly: "Persons must still comply with all applicable predicate rule requirements for record retention and availability (e.g., §§ 211.180(c),(d), 108.25(g), and 108.35(h))." Section III.C.2 does the same for audit trails at "§ 11.10 (e), (k)(2)." In other words, FDA relaxed the Part 11 controls layer and left the predicate-rule clock fully intact, which is exactly the split this article describes.
One consequence is worth stating because it cuts against the usual vendor pitch. The same section says FDA "does not intend to object if you decide to archive required records in electronic format to nonelectronic media such as microfilm, microfiche, and paper, or to a standard electronic file format," and that "as long as predicate rule requirements are fully satisfied and the content and meaning of the records are preserved and archived, you can delete the electronic version of the records." A 25-year obligation does not oblige you to keep a live system running for 25 years. It obliges you to preserve the content and meaning of the record, by whatever medium satisfies the predicate rule.
What This Means for an Electronic Signature System
Retention obligations are only as good as the system's ability to keep the record readable at the end of the period. Part 11's own language, "accurate and ready retrieval throughout the records retention period," puts the burden on the system to survive format changes, software version upgrades, and staff turnover without the record becoming inaccessible or the signature-to-record link breaking. That's the same audit trail integrity requirement we cover in 21 CFR Part 11 audit trail requirements, applied across a retention window that, for a single sponsor running both US and EU trials, can span everything from one year to 25.
Klyverity holds a record and its full signature metadata, printed name, timestamp, signature meaning, and the underlying audit trail, under a single organization-wide retention period set to 2, 12, 25, or 30 years and applied to every document at upload. It also records the named individual responsible for archives, with an audit trail of any transfer of that responsibility, which is the appointment EU CTR Article 58 requires. What it does not do is decide which predicate rule governs a given record. That determination stays with you, and this article exists because it is the part that actually goes wrong. If you want to see how the retention setting, the archive owner, and the audit trail fit together, request a demo.
FAQ
Does 21 CFR Part 11 set its own record retention period?
No. Part 11 requires that records be protected and retrievable "throughout the records retention period" (21 CFR 11.10(c)), but the actual length of that period comes from the predicate rule that required the record, GMP, GLP, GCP/IND, or an equivalent regulation, not from Part 11 itself.
How long must GMP batch records be kept?
21 CFR 211.180(a) requires batch-associated production, control, and distribution records to be retained for at least 1 year after the batch's expiration date, or 3 years after distribution for certain OTC products exempt from expiration dating under 21 CFR 211.137.
What's the retention period for GLP study records?
21 CFR 58.195(b) sets three possible periods and requires the shortest applicable one: 2 years after a related marketing application is approved, 5 years after study results are submitted to FDA (including IND/IDE submissions), or 2 years after the study is completed, terminated, or discontinued in other situations. That "shortest" rule settles the period under Part 58 only. 58.195(a) states that these requirements "do not supersede the record retention requirements of any other regulations in this chapter," so a longer clock elsewhere still governs the same record.
How long do sponsors and investigators have to keep IND records?
Both roles work on a 2-year structure tied to marketing approval or discontinuation. Sponsors retain records under 21 CFR 312.57(c) for 2 years after approval, or 2 years after shipment and delivery for investigational use is discontinued and FDA has been so notified. Investigators retain records under 21 CFR 312.62(c) on the same 2-year timing, tied to approval for the specific investigated indication or to discontinuation with FDA notification.
Why is the EU trial master file retention period so much longer than the FDA periods?
Article 58 of Regulation (EU) No 536/2014 sets a 25-year minimum retention period for the clinical trial master file, "unless other Union law requires archiving for a longer period." That's a policy choice specific to the EU CTR and applies to trials within its scope. It doesn't extend to records governed by the shorter US GMP, GLP, or GCP/IND periods, even for a sponsor running trials in both jurisdictions. Note also that the same article excludes subject medical files from the 25-year clock: "the medical files of subjects shall be archived in accordance with national law."