Archiving

Legal Framework

Public-interest archiving under the GDPR is governed primarily by Article 89, which establishes both the safeguards required and the derogations permitted when personal data are processed for archiving purposes. The framework operates as a layered regime: Article 5(1)(e) sets the general storage limitation principle but expressly permits longer retention for archiving in the public interest, while Article 89(1) requires appropriate technical and organisational measures to protect data subjects' rights throughout the archival lifecycle.

The core obligation under Article 89(1) is unambiguous:

"De verwerking met het oog op archivering in het algemeen belang, wetenschappelijk of historisch onderzoek of statistische doeleinden is onderworpen aan passende waarborgen in overeenstemming met deze verordening voor de rechten en vrijheden van de betrokkene."
— GDPR Art. 89(1)

These safeguards must include technical and organisational measures ensuring data minimisation, with pseudonymisation explicitly contemplated where the archiving purpose can be achieved that way. Where further processing would no longer allow identification of data subjects, such further processing is required.

Article 89(3) provides the critical derogation mechanism for public-interest archiving specifically:

"Wanneer persoonsgegevens met het oog op archivering in het algemeen belang worden verwerkt, kan in het Unierecht of het lidstatelijke recht worden voorzien in afwijkingen van de in de artikelen 15, 16, 18, 19, 20 en 21 genoemde rechten"
— GDPR Art. 89(3)

Member State law may thus derogate from access, rectification, erasure, restriction, portability, and objection rights — but only subject to the Article 89(1) safeguards and only insofar as those rights would render the archiving purpose impossible or seriously impair it. The storage limitation principle in Article 5(1)(e) confirms this:

"persoonsgegevens mogen voor langere perioden worden opgeslagen voor zover de persoonsgegevens louter met het oog op archivering in het algemeen belang, wetenschappelijk of historisch onderzoek of statistische doeleinden"
— GDPR Art. 5(1)(e)

For special categories of data, Article 9(2)(j) provides an exception to the general prohibition, permitting processing where authorised by Union or Member State law for archiving in the public interest, subject to Article 89 safeguards.

Key Developments

Dutch courts have addressed the practical interaction between archiving obligations and access rights, particularly in the context of police data. The Rechtbank has held that the scope of a controller's search obligation corresponds to the specificity of the access request — a general request justifies only a generalised search across the most common data fields, while a more concrete request demands deeper investigation. In one ruling, the court accepted that a municipality had performed a general search of the most common personal data and provided screen prints, plus an overview of processing purposes, data origins, and retention periods — and found this sufficient for a generalised request.

The EDPB has reinforced that retention periods must be purpose-specific:

"Het antwoord op deze en andere soortgelijke vragen is bepalend voor de bewaartermijnen die deel moeten uitmaken van de informatie die beschikbaar is voor de betrokkenen."
— EDPB Guidelines 02/2021 §97

Enforcement decisions across Member States — including the Italian Garante's €400,000 fine against Verisure Italy and the Spanish AEPD's €600,000 fine against GSMA Limited — confirm that retention without demonstrable purpose limitation attracts significant penalties regardless of the archiving context.

Status of the Debate

This topic is contested in court. Courts diverge on the boundaries of public-interest archiving — particularly on the standard for "appropriate safeguards" under Article 89(1) and the scope of permissible derogations under Article 89(3). No definitive CJEU ruling has yet settled whether Member State law alone suffices to establish both the archiving purpose and the derogation, or whether additional GDPR-level scrutiny of proportionality is independently required. The unresolved question is the threshold test: when do derogations from access and erasure rights become "necessary" for archiving rather than merely convenient for the controller? A CJEU preliminary reference on the proportionality boundary of Article 89(3) would resolve the split.

Practical Guidance

• Establish a legal basis in Member State law before relying on Article 89 derogations; the GDPR does not itself create the archiving purpose — it must be grounded in Union or Member State legislation that designates the archiving function.
• Implement data minimisation by design: apply pseudonymisation where the archiving purpose permits, and ensure that when identification is no longer necessary, further processing proceeds in anonymised or at least pseudonymised form.
• Document retention periods per purpose: retention periods must be purpose-specific and transparently communicated to data subjects, not set as uniform blanket periods across entire datasets.
• Calibrate search responses to request specificity: courts have accepted that generalised access requests warrant only generalised searches, but controllers must document the search methodology employed and be prepared to conduct deeper searches for concrete requests.
• Assess special category data separately: where archived data includes Article 9 categories, verify that the Member State law authorisation explicitly covers such processing and that Article 89(1) safeguards are enhanced accordingly.