The practical answer
Keep each record for the longest rule that applies to it. Federal award records generally run 3 years from the financial report under 2 CFR 200.334, longer if an audit or claim is open. GLP study records run 2 to 5 years depending on FDA submission. OSHA treats safety data sheets that indicate a health hazard as exposure records, but they may be discarded if a record of the chemical's identity, where it was used and when is kept for 30 years. [1] [3] [4]
Evidence, method & source dates ↓The trigger matters as much as the number of years
Retention rules rarely say 'keep for 3 years from the purchase date'. They start the clock at an event: submission of a financial report, completion of a study, final disposition of equipment. Two records about the same peptide lot can therefore expire years apart. Write the trigger event next to each record type and the date it happened.
The rules below are the ones we found that can reach a lab buying research peptides. Your institution, funder or contract may set longer periods, and those win. Nothing here replaces your sponsored-programs office or records manager.
Rules that may apply
Federal awards: 2 CFR 200.334 requires recipients to keep award records for 3 years from submission of the final financial report, or from the quarterly or annual report for awards renewed that way. Records must be kept until resolution if litigation, a claim or an audit starts before the period ends, and agencies may extend the period in writing. Property and equipment records run 3 years from final disposition. [1] The NIH Grants Policy Statement, revised March 2026, applies the 3-year period from submission of the annual Federal Financial Report and says scanned images must be full, complete and accurate representations of the original. [2]
GLP studies: 21 CFR 58.195 sets the shortest of three periods: 2 years after FDA approves the application the study supports, 5 years after the results are submitted to FDA, or, if no application results, 2 years after the study is completed, terminated or discontinued. Samples of test articles need only be kept while their quality permits evaluation. [3]
Workplace safety: OSHA's records rule treats safety data sheets indicating that a material may pose a health hazard as employee exposure records, which are kept for 30 years. SDSs need not be kept for any set period if some record of the chemical's identity, where it was used and when, is kept for 30 years. [4] The OSHA laboratory standard requires labs to keep SDSs received with incoming shipments and make them readily accessible. [5]
GMP manufacturers, for comparison only: ICH Q7 asks for production, control and distribution records to be kept at least 1 year after the batch's expiry date, or at least 3 years after complete distribution for materials with a retest date. [6] This binds manufacturers, not research buyers, but shows what a supplier with a GMP system should be able to produce later.
| Rule | Applies when | Minimum period | Clock starts at |
|---|---|---|---|
| 2 CFR 200.334 [1] | Purchase charged to a federal award | 3 years | Final financial report (or quarterly or annual report for renewed awards) |
| 2 CFR 200.334(a) [1] | Audit, claim or litigation begins in time | Until resolved | Resolution and final action |
| NIH GPS 8.4.2 [2] | NIH award | 3 years | Annual Federal Financial Report submission |
| 21 CFR 58.195(b) [3] | Material used in a GLP study | Shortest of 2 or 5 years after FDA events, or 2 years after study end | Approval, submission or study completion |
| 29 CFR 1910.1020 [4] | Employee exposure records, including SDSs that indicate a health hazard | 30 years, or identity record for 30 years in place of the SDS | Not specified in the rule; date each record |
| 29 CFR 1910.1450(h) [5] | SDS received with a lab chemical | Keep and keep accessible | Receipt |
| ICH Q7 6.13 [6] | GMP manufacturer's batch records | 1 year after expiry, or 3 years after distribution with a retest date | Expiry or complete distribution |
Schedule by record type
The minimum column applies the rules above. Where no rule applies, we suggest a lab default of keeping records until the lot is fully used or disposed of, plus any open claim or corrective-action period. That default is our suggestion, not a requirement.
| Record | Rules that may reach it | Minimum | Trigger to note |
|---|---|---|---|
| Quote and product page capture | 2 CFR 200.334 if grant-funded | 3 years | Final or annual financial report |
| Purchase order, invoice, payment record | 2 CFR 200.334; NIH GPS | 3 years, longer if audited | Financial report; audit closure |
| Certificate of analysis | 2 CFR 200.334 if grant-funded; 21 CFR 58.195 if GLP | Longest applicable | Financial report or study completion |
| Safety data sheet | 29 CFR 1910.1020 and 1910.1450 | 30 years, or a 30-year identity record of chemical, place and dates of use | Receipt and use |
| Receiving log and photos | 2 CFR 200.334 as supporting documentation; 21 CFR 58.195 if GLP | Same as the invoice or study file | As above |
| Freezer temperature log | 21 CFR 58.195 if GLP; otherwise lab policy | Study period if GLP | Study completion |
| Independent test reports | Same as the certificate | Longest applicable | As above |
| Claims and corrective action requests | 2 CFR 200.334(a) if in dispute | Until resolved, then as invoice | Closure date |
| Disposal record | 29 CFR 1910.1020 identity record if it is your record of use | 30 years if it is the identity record | Date of disposal |
Worked example
A fictional lab buys two lots of a research peptide on an NIH award in 2026 and uses them only in exploratory laboratory work, not a GLP study. The award's annual financial report covering the purchase is submitted on 2027-01-29.
Invoices, quotes, certificates and receiving records: keep until at least 2030-01-29, 3 years from that report, unless an audit begins first, in which case keep them until it closes. [1] [2] Safety data sheets: the lab may keep the SDSs themselves, or keep a record of the chemical's name, the rooms where it was used and the dates of use; whichever record the lab relies on must last 30 years, to 2056. [4] Freezer logs: no GLP clock applies, so the lab's own policy governs.
If one lot had been used in a GLP study, its certificate, receipt record and characterization data would also follow 21 CFR 58.195, which could run to 5 years after the results are submitted to FDA. [3] Keep the longer of the two periods.
Holds, transfers and destruction
A hold stops the clock. Under 2 CFR 200.334, litigation, claims or audit findings that begin before the period ends keep the records alive until resolved. [1] Mark held records clearly so routine clean-ups skip them.
Under the GLP rule, if a testing facility goes out of business its raw data and documentation transfer to the sponsor's archive and FDA must be notified in writing. [3] The GLP archive rule also expects one person responsible for the archive, controlled access and indexing for prompt retrieval. [7] A small lab can copy those habits: one owner for the procurement archive and an index by supplier and lot.
When records reach the end of their period, record what was destroyed, when and on whose approval. That destruction log is the evidence that a missing record was disposed of on schedule rather than lost.
Checklist
Use this once a year, or when an award closes.
- List each funding source for peptide purchases and the date of each financial report.
- Flag any lot used in a GLP or regulated study and note the study completion and submission dates.
- Confirm SDSs, or a 30-year identity record of chemical, place and dates of use, are held for every hazardous chemical received.
- Check for open audits, claims or disputes before destroying anything.
- Ask your institution's records office whether its schedule is longer than the federal minimum.
- Record every destruction with date and approver.
Questions before you decide
How long do I keep a peptide certificate of analysis bought on a federal grant?
At least 3 years from the financial report that covers the purchase under 2 CFR 200.334, and longer if an audit, claim or litigation starts first or the lot was used in a GLP study.
Do I have to keep safety data sheets for 30 years?
OSHA treats SDSs that indicate a health hazard as exposure records kept for 30 years, but lets you discard the SDS itself if you keep a record of the chemical's identity, where it was used and when for 30 years.
Does the GLP retention rule apply to ordinary research purchases?
Only to material used in nonclinical laboratory studies under 21 CFR Part 58. For other work, grant rules, OSHA rules and your institution's schedule govern.
What should I do with records when the retention period ends?
Check for holds such as open audits or claims, then destroy them and log what was destroyed, when and who approved it.
Check the underlying evidence
Sources & review dates
- 2 CFR 200.334 Record retention requirements (Cornell LII) ↗Accessed 30 Oct 2026
- NIH Grants Policy Statement 8.4.2 Record Retention and Access (revised March 2026) ↗Accessed 30 Oct 2026
- 21 CFR 58.195 Retention of records (Cornell LII) ↗Accessed 30 Oct 2026
- OSHA 29 CFR 1910.1020 Access to employee exposure and medical records ↗Accessed 30 Oct 2026
- OSHA 29 CFR 1910.1450 Occupational exposure to hazardous chemicals in laboratories ↗Accessed 30 Oct 2026
- ICH Q7 Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients ↗Accessed 30 Oct 2026
- 21 CFR 58.190 Storage and retrieval of records and data (Cornell LII) ↗Accessed 30 Oct 2026
Sources are documentary evidence. They do not establish firsthand testing of a listed supplier.