Archiving

Legal Framework

Article 89 GDPR establishes the governing framework for processing personal data for archiving purposes in the public interest, as well as for scientific and historical research and statistical purposes. It requires Member States to provide appropriate safeguards for the rights and freedoms of data subjects, and permits derogations from certain data subject rights — specifically Articles 15, 16, 18, and 21 — when such derogations are necessary for the archiving purpose and likely to render the processing impossible or seriously impair its achievement.

Recital 52 elaborates that the prohibition on processing special categories of personal data under Article 9 may be lifted where Union or Member State law provides for it and appropriate safeguards are established, particularly when processing serves the public interest. The Dutch UAVG Article 45 implements these provisions at the national level, specifying the conditions under which public-interest archiving may proceed.

The rationale is straightforward: archiving in the public interest serves a legitimate societal function — preserving records of enduring value for future generations — but must be balanced against individuals' fundamental rights. The framework therefore permits controlled derogations from certain data subject rights while mandating technical and organizational safeguards to mitigate privacy risks.

Key Developments

Case law has begun clarifying the practical boundaries of archiving obligations. Dutch administrative courts have addressed the scope of search obligations in access requests, holding that where a request is formulated in general terms, a public body may discharge its obligation by conducting a general search across the most common personal data systems. More specific requests demand correspondingly more targeted searches. This distinction directly affects how archived data must be retrieved and disclosed.

Police data retention rules illustrate the layered approach to archiving. Under the relevant Dutch police data provisions, data deleted from active police registers is retained for an additional five years for complaint handling and accountability purposes before destruction. During this retention period, certain data subject rights do not apply — a model that mirrors the Article 89 derogation structure.

The Schrems litigation before the CJEU reinforces that any transfer of archived personal data to third countries requires an adequacy decision or appropriate safeguards under Article 45 GDPR, absent which the processing risks unlawful interference with fundamental rights. The V & EDPS v. European Parliament ruling further establishes that transferring sensitive data — even between EU institutions — constitutes an interference with Article 8 ECHR rights, requiring justification regardless of the final use to which the data is put.

Enforcement actions by the Italian Garante (Verisure, €400,000) and the Spanish AEPD (GSMA, €600,000) demonstrate that retention and archiving practices face significant scrutiny, particularly where retention periods are excessive or purposes are insufficiently circumscribed.

Practical Guidance

• Establish a legal basis under Member State law: Article 89 processing for public-interest archiving requires a specific national legal mandate. Verify that your archiving activity is grounded in applicable Member State legislation implementing Article 89.

• Implement appropriate safeguards before relying on derogations: Technical and organizational measures — pseudonymization, access controls, encryption — must be in place before derogating from data subject rights under Articles 15, 16, 18, and 21 GDPR.

• Document retention periods with precision: The police data model — five-year post-deletion retention for accountability, then destruction — illustrates the level of specificity required. Define clear start dates, durations, and destruction triggers for each archive category.

• Calibrate search responses to request specificity: When responding to access requests involving archived data, match the breadth of your search to the specificity of the request. General requests permit general searches; specific demands require targeted retrieval.

• Assess international transfers of archived data separately: Transferring archived personal data to third countries triggers Article 45 adequacy requirements. Ensure appropriate safeguards are in place, as the Schrems framework applies equally to archived data.