What are data retention and destruction requirements under TCPS 2?

• A. Retain data indefinitely.
• B. Destruction is never required.
• C. Only destroy data after 10 years.
• D. Define retention periods, store securely, and destroy or anonymize data when no longer needed or per consent.

Answer: (D)

The central idea is that TCPS 2 requires a clear plan for how long data will be kept, how it will be stored securely, and what will happen to it at the end of the project. Researchers must define retention periods in the study plan, protect data with appropriate security measures, and destroy or anonymize the data when it is no longer needed or when consent or governance requires it. This protects participants’ privacy, supports ethical data handling, and aligns with ethics approvals and institutional policies. Retaining data indefinitely isn’t the default expectation, and destruction isn’t optional or universally fixed at a particular year like ten; the timing and method depend on the approved plan, consent, and applicable policies. Destruction or anonymization should be carried out in a secure manner when appropriate.