I need to bring my Luxembourg organisation into compliance with article 89 of GDPR (UE 2016/679). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapArticle 89 is often misused as a free pass: an scientific research or statistical purpose label gets stuck onto a processing activity to unlock derogations from data subject rights. The CNPD and the CNIL sanction exactly this abuse: invoking Article 89 without having implemented the appropriate safeguards in paragraph 1, in particular minimisation, pseudonymisation and anonymisation whenever feasible. The trap is twofold: believing the research purpose waives technical safeguards, and forgetting that derogations from Articles 15, 16, 18, 19, 20 and 21 only exist where national law provides for them, never by default.The real conditions to invoke Article 89Article 89 is not a blank cheque. To hold before the CNPD, your processing must combine several concrete proofs.Demonstrate that the purpose is genuinely public-interest archiving, scientific, historical or statistical, and not disguised commercial use.Put in place real, documented technical and organisational measures focused on data minimisation.Pseudonymise as soon as the purposes can be achieved that way, and fully anonymise when identification is no longer necessary.Rely on a precise national legal basis for any derogation from rights (the GDPR alone does not derogate, it refers to Member State law).Compartmentalise: if the processing also serves another purpose (paragraph 4), the derogations only cover the research or statistical part.Test necessity: the derogation is valid only if exercising the right would render the purpose impossible or seriously impair it.How Luxgap automates this riskOur Luxgap Research Safeguard Auditor makes hollow Article 89 claims impossible: it turns your research purpose assertion into an opposable safeguards file. An AI agent analyses your datasets in your connected warehouses (PostgreSQL, Snowflake, Azure Data Lake, SharePoint, Sage BOB 50) and continuously assesses the residual identification level of each column, telling you what must be pseudonymised or anonymised.Automatically scans your research tables and files and detects directly or indirectly identifying fields through re-identification analysis (k-anonymity, l-diversity).Calculates a minimisation score per processing activity and alerts when personal data persists while the purpose could be achieved through anonymisation.Generates the Article 89(1) safeguards register, listing technical measures, applied pseudonymisation and the national legal basis invoked for each derogation.Verifies paragraph 4 compartmentalisation by detecting mixed processing that also serves a commercial purpose not covered by the derogations.Produces a timestamped PDF report, opposable to the CNPD during an audit, proving that derogations from Articles 15, 16, 18, 19, 20 and 21 rest on genuine necessity.Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real datasets, with a free...

EU frameworkGDPRNIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article 89

Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

General Data Protection Regulation · UE 2016/679

Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

1. Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.

2. Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

3. Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes.

4. Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs.

Luxembourg specificity

loi luxembourgeoise du 1er aout 2018 portant organisation de la Commission nationale pour la protection des donnees

In Luxembourg, the law of 1 August 2018 organising the CNPD specifies the safeguards applicable to processing for scientific or historical research, statistical and public-interest archiving purposes. It frames in particular the derogations from data subject rights and requires pseudonymisation measures together with a documented proportionality analysis. The competent authority is the CNPD, never another body.

Luxgap practice: before invoking Article 89 for a university research project or a sector-wide statistical processing, have the precise national legal basis validated by the CNPD and keep written proof of the technical safeguards in place.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Article 89 is often misused as a free pass: an scientific research or statistical purpose label gets stuck onto a processing activity to unlock derogations from data subject rights. The CNPD and the CNIL sanction exactly this abuse: invoking Article 89 without having implemented the appropriate safeguards in paragraph 1, in particular minimisation, pseudonymisation and anonymisation whenever feasible. The trap is twofold: believing the research purpose waives technical safeguards, and forgetting that derogations from Articles 15, 16, 18, 19, 20 and 21 only exist where national law provides for them, never by default.

The real conditions to invoke Article 89

Article 89 is not a blank cheque. To hold before the CNPD, your processing must combine several concrete proofs.

Demonstrate that the purpose is genuinely public-interest archiving, scientific, historical or statistical, and not disguised commercial use.
Put in place real, documented technical and organisational measures focused on data minimisation.
Pseudonymise as soon as the purposes can be achieved that way, and fully anonymise when identification is no longer necessary.
Rely on a precise national legal basis for any derogation from rights (the GDPR alone does not derogate, it refers to Member State law).
Compartmentalise: if the processing also serves another purpose (paragraph 4), the derogations only cover the research or statistical part.
Test necessity: the derogation is valid only if exercising the right would render the purpose impossible or seriously impair it.

How Luxgap automates this risk

Our Luxgap Research Safeguard Auditor makes hollow Article 89 claims impossible: it turns your research purpose assertion into an opposable safeguards file. An AI agent analyses your datasets in your connected warehouses (PostgreSQL, Snowflake, Azure Data Lake, SharePoint, Sage BOB 50) and continuously assesses the residual identification level of each column, telling you what must be pseudonymised or anonymised.

Automatically scans your research tables and files and detects directly or indirectly identifying fields through re-identification analysis (k-anonymity, l-diversity).
Calculates a minimisation score per processing activity and alerts when personal data persists while the purpose could be achieved through anonymisation.
Generates the Article 89(1) safeguards register, listing technical measures, applied pseudonymisation and the national legal basis invoked for each derogation.
Verifies paragraph 4 compartmentalisation by detecting mixed processing that also serves a commercial purpose not covered by the derogations.
Produces a timestamped PDF report, opposable to the CNPD during an audit, proving that derogations from Articles 15, 16, 18, 19, 20 and 21 rest on genuine necessity.

Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real datasets, with a free scan within 48h to measure your exposure before any commitment.

Need help?

Our team (lawyers + cyber engineers + developers) supports you. Free quote within 48h.

Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

They trust us

Before we chat