My institution - University College Dublin has a number of guidelines and policies on the security and retention of research data (link to page here). The main points are that UCD own all data unless otherwise specified in funding agreement. The responsibility of storage, protection/security and retention of data is down to the principal investigator and the researchers obtaining and using the data. PIs and researchers must protect the rights and privacy of individuals in accordance with the Data Protection Act 1988 and the Data Protection (Amendment) Act 2003 when using data obtained for research from individuals.

The guidelines are useful, it is good to have them, but to really understand them and the legalities of obtaining, retaining and protecting data PIs and researchers would have to look to other sites.