13 October 2026

Data Protection and  Archival Services (The Special Case)

By Jess Pembroke, Chief Operating Officer

My early career was spent in operational data protection roles across public services, including busy NHS hospitals, community Trusts and education settings. As Data Protection Officers (DPO) in these environments, we often focus on the principle that less is more: setting appropriate retention periods, securely destroying data we no longer need, explaining how personal data is used through privacy notices, and considering access primarily through the rights of the data subject. Since joining Naomi Korn Associates five years ago, I have had the opportunity to work with archives across public sector and commercial organisations. Although data protection remains just as important in this context, it requires a very different approach.

Archives are custodians of far more than personal data. Their collections may include information about living individuals, deceased information, business or historical records, details that allow inferences to be drawn about third parties, and significant volumes of special category or criminal offence data. Much of this material is highly sensitive and may need to remain closed, in some cases at least until the individuals concerned have died. However, archives also hold information about living people, and a central part of their role is to provide appropriate access because preserving records is not an end in itself. Their value lies in enabling research, education, accountability and understanding, all of which can serve the wider public interest.

Here are three of the key lessons I learned when working in this space:

Lesson 1: Roles of Data Processors and Controllers

One of the most important starting points when applying data protection to archives (that contain personal data of living individuals) is understanding the roles of everyone involved. The fact that an archive holds the material does not necessarily mean that it remains responsible for everything that subsequently happens with the personal data in it.

Take the example of a university student accessing an archive for academic research. The archive is likely to be a controller in relation to its decision to preserve the records and to provide access to them. The university may be a separate controller for the research where it determines the research framework, provides ethical oversight, sets security requirements or otherwise has responsibility for the project. The student will usually be operating within that framework rather than acting as a processor for the archive. An independent researcher who determines their own purposes and methods may be a data controller themselves.

Consider another example: a depositor who loans a collection to an archive. The depositor may remain a controller where they continue to determine why and how the personal data is used—for example, by retaining ownership, setting access restrictions or approving particular uses. At the same time, the archive may be a controller in its own right for decisions about cataloguing, preservation, security and access. The arrangement may therefore involve separate or, depending on the circumstances, joint controller responsibilities rather than a simple controller–processor relationship. The practical reality of who determines the purposes and means of processing must be assessed and clearly documented.

Understanding the real relationship between the parties helps archives make better decisions about access, responsibilities and what agreements are required.

Lesson 2: Keeping personal data is not the same as keeping it without justification Archival services  are built around preservation, while one of the best-known data protection principles tells us that personal data should not be kept for longer than necessary. At first sight, those two objectives can look difficult to reconcile, but permanent preservation is not automatically incompatible with data protection. The more useful question is why the information is being retained, whether the relevant provisions for archiving in the public interest apply, and whether appropriate safeguards are in place.

Archival services  need to be able to demonstrate a considered approach to accession, appraisal, retention, access and disposal rather than relying on the simple assertion that “we’re an archive, so we keep everything forever”. Depositor agreements form part of that governance, but archives must also take a long-term view of a collection’s potential value. Material that appears to have limited historical or research significance today may become important as society changes, new research questions emerge or previously overlooked communities and experiences receive greater attention.

That future value of archival material cannot always be predicted at the point of accession or appraisal. This does not mean privacy rights should be disregarded: archives should use proportionate safeguards, such as access restrictions, closure periods, careful cataloguing and documented review, to reduce risks to living individuals. The aim is to protect people’s rights without unnecessarily removing or destroying records that may contribute to the preservation and understanding of our shared history.

The legal basis on which you are processing the data will also be important, and the Generally Recognised Standards[1] which was produced by Naomi Korn Associates on behalf of ARA and which I had the privilege to co-author is a great guide to understanding archival responsibilities for data originally collected on the basis of consent[2].

Lesson 3: Archives are a Special case

Data protection law (UK General Data Protection Regulation and Data Protection Act 2018) list archive provisions in multiple places. There are therefore important provisions and exemptions that archives need to understand, particularly around transparency and individual rights. For example, where an archive holds information about a very large number of people and the data was not obtained directly from them, Article 14(5)(e) UK GDPR may apply if providing privacy information to each individual would be impossible or involve disproportionate effort. This must be assessed and documented, taking account of factors such as the number of individuals, the age of the records and the safeguards in place. The archive must still take appropriate transparency measures, including making the privacy information publicly available. Similarly, a request for erasure does not necessarily mean that information must automatically be removed from an archival record. These provisions may be unfamiliar to data protection professionals working in operational settings because they are relatively specialised and may arise infrequently in day-to-day practice.

If you are working as a Data Protection Officer in an operational capacity, does your organisation have an archival service, or are you an archivist unsure about how to apply data protection laws? Our Data Protection Law for Archives, Museums and Library Collections course will help you move from uncertainty to a clearer, more defensible approach. Through practical guidance and archive-specific examples, the course equips participants to recognise responsibilities, apply relevant provisions and exemptions, and make well-reasoned decisions that support both lawful processing and the long-term preservation of collections. The course next runs on 9 November (12:30-4pm). To book your place, use the link above or contact our Operations  Manager at info@naomikorn.com. 

[1] ARA+Generally+Recognised+Standards+25.3.26+FINAL.pdf

[2] Section 71 of the Data (Use and Access) Act 2025, which inserted Article 8A into the UK GDPR.