# Stay on top of research data governance

Published: 6 November 2026

Friday Drop 010. Keep retention periods within a range, see what's due for deletion, handle DSARs step by step and get your DPA in the app.

Source: https://participantkit.com/updates/stay-on-top-of-research-data-governance

![Stay on top of research data governance. Three cards: ensure data retention periods are within a range, see what's due for deletion and a new and improved DSAR process from find to erase. A Now with more governance badge sits on the last one. Friday Drop, batch number 010](https://participantkit.com/assets/images/updates/friday-drop-2026-11-06.png)

Friday Drop, batch 010. This one is for admins. You set the rules for how your team keeps and deletes research data. This week's changes help everyone stick to them.

Back in [batch 001](https://participantkit.com/updates/we-have-been-building-a-lot-and-telling-you-almost-nothing) we said there was a lot we'd built and never told you about. Do-not-contact and self-serve DPAs were on that list. Here they are, with a new retention setting and a better way to handle data requests.

## Set the retention periods your team can choose

Your organisation has a default retention period. Every new consent or agreement form starts with it. Researchers can still change it to suit their study.

One customer changed their retention policy from three years to two. They wanted to make sure nobody kept setting the old three years.

Now you can set a range. Choose the shortest and longest period your policy allows. Researchers still pick the period that fits their study, but only inside that range. If they try to go outside it, the form builder tells them what the range is.

Want everyone on one period? Put both ends on the same value.

![Organisation settings with a default retention period of 2 years and a retention range slider set from 1 year to 2 years](https://participantkit.com/assets/images/updates/drop-010-retention-range.png)

![A consent form's retention period set to 3 years, with the error Choose a length your organisation allows: 1 year to 2 years](https://participantkit.com/assets/images/updates/drop-010-retention-error.png)

Nothing changes until you set a range. When you do, we highlight any templates and forms outside it, so you can correct them in place.

## See what's due for deletion

Retention review shows every study where all the consents have passed their retention period. Studies due in the next 30 days are listed too, so nothing catches you out.

Each study shows its retention period, how many participants it has and how much linked data. When you're ready, delete the study and everything in it.

You'll find it in the sidebar, under **Compliance**.

![Retention review in the Compliance section of the sidebar. Two studies are listed: one expired about 2 months ago and one expires in 19 days. Each shows its retention period, participants, linked data items and consent counts, with a Delete study and all data button](https://participantkit.com/assets/images/updates/drop-010-retention-review.png)

## Handle a data request step by step

When someone sends a data subject access request (DSAR) or asks you to delete their data, you need to find everything and prove you did it. You could always do this in Participant Kit, but it wasn't obvious how. Now data requests have their own section, with a step-by-step process.

1. **Find them** by their email address or any ID they were given
2. **Review** everything you hold about them in one place
3. **Export** it as a CSV if they asked for a copy
4. **Erase** them, if they asked for that

Erasure removes everything we hold, not just the person record. Their consents, emails sent, panel data and activity history all go. You get a confirmation of what was deleted and when.

The request itself stays on record, with who handled it and every step they took. That's your evidence.

Hopefully you won't need it often. It's there when you do.

![A person's data page in Data requests, with their details and sections for panels, panel data, screener responses, studies and notes. A Log a request button sits at the top right](https://participantkit.com/assets/images/updates/drop-010-data-request-review.png)

![The confirmation after erasing someone's data: a record of each step with who did it and when. Below it, a count of what was deleted](https://participantkit.com/assets/images/updates/drop-010-erasure-confirmation.png)

## Do-not-contact that stays put

When someone opts out of all contact using the link in any email, they're left out of everything: studies, panels, shortlists and broadcasts, across your whole organisation. Nobody can add them back by mistake.

That holds even after they're deleted. If the same email address is imported again later, it's still marked. We don't keep the address itself, just a code that can only match it.

Erasing someone through a data request does the same automatically.

## Get your DPA in the app

Your legal team will ask for a data processing agreement. You can now fill in your organisation's details on ours and download a personalised copy without leaving Participant Kit. When you're ready, click **Get it signed** and we'll sign it.

## Where to find them

- **Retention range:** Organisation settings, under **Retention range**. The [data retention help article](https://participantkit.com/help/set-data-retention) has the steps
- **Data requests:** in the sidebar, under **Compliance**
- **DPA:** Organisation settings, under **Legal**