NHS Clinical Trial Records Retention: What the 25-Year Rule Really Means

Since the updated UK clinical trial regulations from the HRA and  MHRA came into force on 28 April 2026, one issue has repeatedly surfaced for NHS organisations running clinical trials: what does 25-year records retention actually mean in practice? 

At first glance, the change appears straightforward. Essential clinical trial records must now be retained for 25 years instead of 5. Operationally, however, the impact is far more significant. 

For NHS  research organisations, this is a shift toward long-term records governance, where organisations must ensure research records remain accessible, understandable, and defensible over decades of organisational and technological change. 

The Real Challenge Is Not Storage 

Retaining files for 25 years is technically achievable. The greater challenge is ensuring those records still retain their evidential value decades later. 

Over that timeframe, systems will inevitably be replaced, file formats may become obsolete, folder structures will evolve, metadata may become inconsistent, and staff knowledge will gradually disappear. Together, these changes create a genuine risk of “digital decay”, where records still exist but can no longer be reliably interpreted or even accessed. 

In a clinical trial context, that matters. If an approval cannot be traced, an audit trail is incomplete, or the relationship between records and the study itself becomes unclear, organisations may struggle to demonstrate regulatory compliance years after a study has closed. 

The issue is therefore not simply preservation of data, but preservation of context, traceability, and evidential integrity. 

The Operational Challenge of 25-Year Retention in NHS Research 

As Sandra Blake – Barts Health NHS Trust mentioned in a recent panel discussion, NHS research operations are often highly localised. Research has historically been built around site-level solutions such as shared drives, paper files, eISF solutions, and file-sharing platforms. These approaches have generally evolved around operational convenience rather than long-term records governance. 

SharePoint is a good example. Across the NHS, it has become a widely used collaboration platform. In practice, however, it is often managed as a flexible workspace rather than a controlled records management environment. Folder structures, metadata standards, naming conventions, and version control can vary significantly between teams. 

Over a 5-year retention period, these inconsistencies may remain manageable. Over 25 years, they become operational risks. 

Parallel Retention Regimes Add Complexity 

The challenge is compounded by the fact that NHS organisations must now manage two retention regimes simultaneously. 

Older studies may still fall under previous 5-year retention requirements, while newer studies are subject to the 25-year obligation. Many existing processes were never designed to manage this overlap cleanly. 

Without clear oversight, organisations risk inconsistent retention decisions, fragmented ownership, duplicated records, or accidental destruction of material that remains in scope. This shifts retention from a passive administrative activity into an active operational process requiring governance, accountability, and long-term visibility. 

A Risk-Based Approach to Clinical Trial Records Retention 

Not all records carry the same level of importance, and not all risks are equal. This is where a risk-based approach becomes essential, allowing organisations to focus effort where it genuinely matters by identifying which records are critical for compliance, and which systems or processes present the greatest long-term vulnerability. 

It also recognises something important: risk is not static. Records that appear routine at the point of study closure can become significant years later if safety concerns arise, results are challenged, or regulatory inspections revisit historical trials. 

A useful example of this approach in practice can be seen at Barts Health NHS Trust, which has developed a more structured, risk-led approach to managing long-term research records as part of its wider digital preservation strategy. Rather than treating all research data in the same way, the organisation has focused on differentiating between records that require long-term controlled preservation and those that can remain within operational systems, ensuring that effort is directed towards the highest-risk, highest-value material. As simple risk assessment matrix like the one below can be used. 

Risk Assessment Matrix 

This kind of thinking is particularly important in clinical research environments, where the Investigator Site File, for example, remains a core regulatory record that must be retained for extended periods and may need to be accessed long after a study has formally closed.  

A risk-based approach is about making deliberate, documented decisions about what must be preserved, ensuring those decisions are proportionate, and being able to justify them in the future if they are ever challenged. 

The 25-Year Rule Is Really a Test of Operational Resilience 

The new retention requirement is often described as a regulatory update. 

In reality, it is a broader test of whether NHS research organisations can sustain long-term continuity across systems, governance, and institutional knowledge. 

The organisations that adapt successfully will not simply be those that store records for longer. They will be the ones that treat long-term retention as an operational capability rather than an administrative afterthought. 

Because over 25 years, the challenge is not whether records survive. It is whether they still mean anything when someone eventually needs them. 

If you would like more information on the new UK Clinical trial update and how it relates to record retention, we also have an eBook available.