Article 89 of the GDPR: Guarantees and exemptions for processing for archival, research or statistical purposes
Article 89 of the GDPR: Guarantees and exemptions for processing for archival, research or statistical purposes
Article 89 of the GDPR provides for specific guarantees for data processing carried out at archival purposes in the public interest, scientific or historical research, or statistical purposes.
Article 89 of the GDPR explained
According to this article:
- Processing for these purposes benefits from exemptions from individuals' rights (access, rectification, opposition, etc.), provided that adequate guarantees are implemented;
- These guarantees include pseudonymization, data minimization, access limitation or even specific retention periods;
- The goal is to enable scientific progress, collective memory or statistical analysis while protecting fundamental rights.
Why is this article important for your GDPR compliance?
It makes it possible to adapt the GDPR to public interest purposes, while imposing reinforced security and supervision obligations. Organizations conducting research or archiving projects must balance innovation and privacy.
How to comply with Article 89 of the GDPR?
- Clearly document the scientific, historical or statistical purpose of the processing;
- Apply technical measures such as pseudonymization or anonymization;
- Assess whether certain rights can be legitimately restricted (through an impact assessment if applicable);
- Contractually regulate access to data (e.g. research agreements, partnerships).
Examples of application of Article 89 of the GDPR
- A university pseudonymizes the data collected for medical research;
- An archives service maintains administrative records for national historic interest;
- A statistical institute produces analyzes from anonymized datasets.
Related Resources
Accelerate your compliance in just a few clicks
With our all-in-one solution, you can accelerate and ensure compliance easily:
- Automate your compliance with our GDPR software
- Supported or outsourced by our DPO experts
- Raise awareness among your teams with our GDPR training e-learning
Assess your situation in 15 minutes with our free, no-obligation GDPR self-diagnosis.
