Market research data retention: how long to keep respondent data

How long should an agency keep respondent data?#

An agency should keep respondent data only as long as each data type has a documented purpose, which means a market research data retention policy needs several clocks, not one. Contact details exist to recruit and pay incentives; raw response files exist to check quality and answer client questions; de-identified study data can support trend analysis and norms for much longer.

The period for each clock comes from three places: the client contract, the privacy notice and consent text respondents saw, and the laws that may apply to the respondents in the study. Where those sources differ, the shortest applicable period usually wins. Write the source next to every period so the next reviewer can see why it was chosen.

Retention schedule template by data type#

Use the template below as a starting schedule. Each row names the record, where it usually lives, the event that starts its clock and the action when the period ends. Add a period column filled from your own contracts and notices; the template leaves periods out on purpose because they differ by client and jurisdiction.

How do you set the period for each row?#

Set each period by reading the documents that bind the agency, then choosing the shortest period they allow for that data type. Work through them in the same order for every client so the schedule stays consistent and the reasoning is easy to audit.

• 1Client MSA and SOW: look for retention, return-or-destroy and audit clauses, and note whether destruction covers derived datasets.
• 2Privacy notice and consent text: check what respondents were told about how long data is kept and for which purposes.
• 3Sample and panel supplier terms: some suppliers limit how long respondent-level files may be kept.
• 4Laws that may apply: the EU GDPR or UK GDPR for respondents in those regions, and US state privacy laws depending on where respondents live, assessed with counsel.
• 5Your professional code: check what the research code your agency follows says about keeping personal data.
• 6Accounting rules: incentive payment records may need to outlast the respondent data they relate to.

Legal holds: the switch that overrides every clock#

A legal hold suspends deletion for any record that may be relevant to a dispute, investigation or regulatory inquiry, and it overrides every row in the schedule until counsel lifts it. The policy should name who can place a hold, how it is recorded and which systems it reaches.

The weak point is automatic deletion inside tools, which runs regardless of the written policy. Zoom, for example, lets admins delete cloud recordings after a specified number of days counted from each recording's creation, with an option to exempt individual recordings. When a hold starts, check those settings in every affected tool and exempt the held files.

Keep a simple hold log: matter, scope, systems, date placed, approver and date released. When a hold ends, apply the normal clocks again: delete what has passed its period and leave the rest on schedule.

Retention and value: what de-identification changes#

De-identification changes which clock applies, but only if it is real. A cleaned dataset with names, emails and panel IDs removed can often move from the short identifying clock to the longer study-data clock, provided the contract and notice allow it.

Pseudonymization is not the same thing. GDPR Recital 26 says personal data that has been pseudonymised and could be attributed to a person using additional information should be considered information on an identifiable person. If the agency keeps a key linking respondent IDs back to its panel, personal-data rules still apply to that dataset.

California sets its own bar. Under the CPRA amendments, information counts as deidentified only if the business takes reasonable measures against re-identification, publicly commits to keep it in deidentified form and contractually binds recipients to the same rules. An agency that wants long-term value from its archive, including possible licensing, needs that discipline in place while it keeps the data.

Illustrative: a consumer insights agency rebuilds its schedule#

Illustrative: a fictional consumer insights agency runs quantitative studies in a survey platform, recruits qualitative participants from its own database and stores Zoom recordings and transcripts on a shared drive. Its old policy kept every project folder for one fixed period, with no distinction between data types.

The operations lead maps each data type to a row in the new schedule. Screener and contact data now delete at fieldwork close, recordings delete after analysis, and identified transcripts are replaced by de-identified versions. Several enterprise contracts require return or destruction, so those studies are flagged and excluded from long-term keeping.

The review also shows that Zoom auto-deletion had already removed older recordings, which settles the question for those projects. The result is a smaller, documented archive of de-identified study data the agency can use for trend work and, where rights allow, consider for licensing.

How SourceX treats retention in a licensing review#

SourceX only considers records an agency has kept lawfully and in line with its own policy, and it never asks an agency to keep data longer than its schedule allows. In the Supply and Rights steps of the SourceX five-step transaction, the retention schedule is one of the first documents reviewed, because it shows which studies still exist and on what terms.

For any package that proceeds, the privacy record in the SourceX Evidence Packet notes the de-identification method, the retention basis and any hold or deletion obligations, so the agency and the licensee work from the same facts.