Does the 7 year retention requirement apply to confidential or third-party data subject to data use agreements that require return or destruction of data prior to the expiration of the retention period?

The terms of any data use agreement[1] for confidential or third-party data take precedence over the University’s data retention requirements. 

[1] Please note that all DUAs must be reviewed by a School’s IRB, School Security Officer and relevant Sponsored Programs Administrator (or School officials to whom this responsibility has been delegated by the cognizant  Sponsored Programs Administrator) before the DUA may be accepted and signed by the Office of Sponsored Programs, the HMS Sponsored Programs Administrator or the HSPH Sponsored Programs Administrator.  No researcher may accept a DUA without such review or sign a DUA.  

See also: Data Retention