1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.
Article 89 GDPR - Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
2. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
3. Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.
4. Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs.
Relevant Recitals
- Recital 156 Processing for Archiving, Scientific or Historical Research or Statistical Purposes
- Recital 157 Information from Registries and Scientific Research
- Recital 158 Processing for Archiving Purposes
- Recital 159 Processing for Scientific Research Purposes
- Recital 160 Processing for Historical Research Purposes
- Recital 161 Consenting to the Participation in Clinical Trials
- Recital 162 Processing for Statistical Purposes
- Recital 163 Production of European and National Statistics
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Paragraph 1 subjects such processing to appropriate safeguards for the rights and freedoms of the data subject, implemented through technical and organisational measures that ensure in particular respect for the principle of data minimisation in point (c) of Article 5(1). This paragraph is also the gateway for the privileges the Regulation grants these purposes elsewhere, such as the compatibility presumption in point (b) of Article 5(1), extended storage under point (e) of Article 5(1) and the special-category basis in point (j) of Article 9(2), all of which apply only where Article 89(1) safeguards are in place.
Paragraph 1 makes pseudonymisation, as defined in Article 4(5), a permitted safeguard where the purposes can still be fulfilled in that manner. It goes further for anonymisation, since where the purposes can be fulfilled by further processing which does not permit, or no longer permits, the identification of data subjects, the paragraph requires that they be fulfilled in that manner.
Paragraph 2 allows Union or Member State law to derogate from the rights of access (Article 15), rectification (Article 16), restriction (Article 18) and objection (Article 21). The derogation must respect the safeguards of paragraph 1, and it is available only in so far as those rights are likely to render impossible or seriously impair the achievement of the specific purposes and the derogation is necessary for their fulfilment.
Yes. Paragraph 3 permits derogations from the same rights as paragraph 2 and additionally from the notification obligation of Article 19 and the right to data portability in Article 20, under the same necessity and impairment conditions.
Paragraph 4 confines the derogations to the processing carried out for the archiving, research or statistical purposes themselves. Any concurrent purpose remains fully subject to the ordinary rules of the Regulation, so the controller must be able to separate the two strands of processing.