Research Data Retention and Deletion: How Long Should You Keep Interview Data?

The short answer

There is no universal legal retention period for research data. The law requires you to decide, document, and enforce one — so the absence of a schedule is itself the compliance failure.

Under GDPR's storage limitation principle (Article 5(1)(e)), personal data may be kept only as long as necessary for the purpose it was collected for. That is a relative standard: it obliges you to define the purpose, derive a period from it, and then actually delete on schedule.

The second key idea, which most teams miss:

Retention is a per-artifact decision, not a per-study decision. A single 45-minute interview generates a recording, a transcript, a set of coded themes, a handful of verbatim quotes, a consent record, and a contact record for paying the incentive. Those six artifacts have wildly different risk profiles and wildly different useful lifespans. One blanket rule gets it wrong in both directions at once — holding raw audio far too long while deleting the analysis you actually needed.

Not legal advice. Retention periods interact with your jurisdiction, sector, and contracts; validate your schedule with counsel.

The recommended tiered schedule

Adapt the periods, keep the structure. These are defensible defaults, not legal minimums.

The recording tier deserves emphasis. Raw audio is the most sensitive artifact you hold and, once you have an accurate transcript, usually the least useful. Teams keep it out of vague anxiety about needing to "go back to the tape." In practice they almost never do — and meanwhile the recording is the thing that turns a routine security incident into a serious one.

Anonymization is the lever that lets you keep insight forever

This is the most valuable mechanic in retention design, and it is widely misunderstood.

• Pseudonymized data — real identifiers swapped for codes, with a key that still exists somewhere — is still personal data. The retention clock keeps running.
• Genuinely anonymized data — where re-identification is no longer reasonably possible, and no key exists — falls outside GDPR's scope. The clock stops.

So the way to retain research value indefinitely without indefinite risk is not to argue for longer retention periods. It is to de-identify at the point of synthesis, so that your durable artifacts — reports, theme libraries, quote banks — never contain personal data in the first place.

Be honest about the bar, though. Qualitative data resists anonymization more than survey data, because narrative detail identifies people. "The VP of Engineering at a 40-person Berlin fintech who joined last March" is identifiable no matter what you call them. Strip role-plus-company-plus-timeline combinations, not just names. See anonymizing customer interview data for the mechanics.

What specific regimes require

GDPR — storage limitation (Art. 5(1)(e)) plus the right to erasure (Art. 17). You must be able to find and delete one participant's data on request. That is an architecture requirement, not a policy statement: if you cannot locate everything about one person, you cannot comply. See GDPR-compliant AI user research.

COPPA — the amended Rule explicitly prohibits retaining a child's personal information indefinitely, limits retention to what is reasonably necessary for the collection purpose, and expects a written, published retention policy. See research with children and teens.

Illinois BIPA — requires a publicly available written retention schedule and destruction guidelines for biometric identifiers, with destruction when the initial purpose is satisfied or within three years of the individual's last interaction, whichever comes first. The simplest compliance posture for a research team is to not create voiceprints at all — see interview recording consent laws.

US state privacy laws — the comprehensive laws now in effect across roughly 20 states generally require disclosing retention practices and honoring deletion requests, with sensitive categories attracting opt-in consent.

Sector and contract terms frequently override all of the above. Healthcare, financial services, and enterprise DPAs often specify periods directly; your customer's contract may be stricter than any statute.

Handling a deletion request without losing the finding

The hard case: a participant asks you to delete their data six months after their quote landed in a report that shaped your roadmap.

What must go: the recording, the transcript, identifiers, the linkage between person and response.

What generally survives: aggregate findings and genuinely de-identified insights. Deleting a source does not obligate you to unlearn a conclusion. If four of twelve participants struggled with the same step, the finding "a third of participants struggled here" remains valid and contains no personal data.

Where teams get stuck is verbatim quotes in published decks. A distinctive quote can identify its speaker. Two ways to avoid the problem entirely:

1. De-identify quotes at synthesis time, so nothing downstream needs revisiting.
2. Keep a quote-to-source map in one place only — the research platform — so a deletion request has a single point of execution rather than a scavenger hunt across Notion, Slack, decks, and someone's laptop.

That second point is the real argument for keeping research data in one system. Sprawl is what makes deletion requests unanswerable.

Writing the policy: six elements

1. Scope — which artifacts, which systems, which studies
2. A period per artifact tier, with the reasoning recorded
3. The trigger — is the clock from collection date, study close, or last participant interaction?
4. The mechanism — automatic deletion beats manual cleanup, which never happens
5. Exceptions — legal hold, active dispute, contractual requirement, and who authorizes them
6. An owner and a review cadence — annually, with a named accountable person

Then do the thing almost nobody does: run a deletion drill. Pick one past participant and try to delete everything about them. Whatever you cannot find is your actual compliance gap, and it is invariably a spreadsheet or a slide deck rather than the research platform.

How this works with Koji

• The transcript is the durable artifact, and the recording does not have to be. Because every session yields a complete verbatim transcript, deleting raw audio early costs you very little analytically — which makes the shortest, highest-value retention tier genuinely practical.
• Structured questions produce findings that survive deletion. With the six question types — open_ended, scale, single_choice, multiple_choice, ranking, yes_no — quantitative results aggregate into distributions and rankings that carry no personal data. When a participant exercises erasure, your scale distributions and choice frequencies remain intact because they were never personal data to begin with. That is a real structural advantage over a pile of recordings, and the structured questions guide covers building studies that way.
• Reports are synthesized outputs, so the insight layer you keep long-term is separable from the identifiable layer you delete on schedule.
• Collect less up front. The cheapest retention policy is a study scoped so it never gathers identifiers — no full names, no employer, no free-text field inviting people to volunteer personal details.
• Text mode removes the audio tier entirely for sensitive studies. See voice vs text interviews.
• Export before deletion. Take the de-identified analysis into your repository so the schedule never costs you institutional memory — see the research repository guide.

Confirm current storage locations, sub-processors, and configurable retention settings during procurement, and record the answers in your policy — see enterprise security for AI research platforms and AI interview data privacy and security.

Common mistakes

1. No written schedule. The most common failure, and the one that turns any incident or audit into an unnecessary problem.
2. One blanket period for everything. Different artifacts, different risk, different value.
3. Keeping raw recordings forever because deleting feels irreversible. Transcribe, verify, then delete.
4. Confusing pseudonymization with anonymization. Only genuine anonymization stops the clock.
5. Deleting consent records along with the data. You need them to show your lawful basis.
6. Manual cleanup. If deletion is a calendar reminder, it will not happen. Automate it.
7. Data sprawl across decks, spreadsheets, and Slack, making erasure requests impossible to fulfill honestly.
8. Mixing incentive and payment records into the research corpus. Different purpose, different clock, different system.
9. Never testing the policy. Run the deletion drill.

Related Resources

• Structured Questions Guide — build studies whose findings survive deletion
• Anonymizing Customer Interview Data — the de-identification mechanics that stop the clock
• GDPR-Compliant AI User Research — storage limitation and erasure in practice
• Interview Recording Consent Laws — why biometric artifacts need a published schedule
• User Research With Children and Teens — the stricter COPPA retention rule
• Research Repository Guide — keep the insight after the data is gone
• Enterprise Security for AI Research Platforms — what to verify during procurement
• IRB Approval for User Research — the data-management plan reviewers expect
• Most of Your Research Should Not Be Kept - appraisal, the value judgement that operates inside these legal limits
• Nobody Logged the Deletion - the disposal register that keeps removals visible