The classic trap
Recital 158 informs Article 89 GDPR on archiving in the public interest. The trap regularly flagged by the CNPD and CNIL: confusing operational retention (active or intermediate data kept for business needs) with permanent archiving in the public interest. Many organisations invoke archiving to justify indefinite retention, when only legally mandated archival services (Archives nationales du Luxembourg, public archive services under the law of 17 August 2018) qualify for the extended Article 89 derogations. An SME keeping ten years of HR emails is not archiving: it is retaining, subject to storage limitation.
Criteria to qualify processing as archiving under Recital 158
- Legal obligation to acquire, preserve, appraise, arrange and provide access (not a mere internal option).
- Documented public interest: historical research, collective memory, democratic transparency, fight against revisionism.
- Permanent preservation (not limited duration post business need).
- Identified service: national archives, ministerial archive services, private bodies delegated a public archival mission.
- Appropriate safeguards under Article 89(1): pseudonymisation, minimisation, access controls, logical separation of fonds.
- Non application to deceased persons: GDPR does not apply, but national law may provide protections (in Luxembourg, image rights and professional secrecy persist).
The grey zone: corporate memory vs public archiving
A private bank, a law firm or an industrial group in Luxembourg are not archival services within the meaning of Recital 158. Their long retention (10 years AML/CFT, 30 years contracts, etc.) falls under sector-specific legal obligations, not Article 89 archiving. Two distinct registers are therefore needed: a regulatory retention register and, where relevant, a formal deposit with the Archives nationales for fonds of historical interest.
How Luxgap automates this risk
Our Luxgap Retention Intelligence Engine definitively settles the question "is this archiving or over-retention?" for every dataset in your IS. The tool continuously scans your M365 shares, AWS S3 buckets, Odoo and SAP databases, Veeam archives and document vaults, then automatically classifies each fonds into one of four legal categories: active, intermediate, Article 89 permanent, or unlawful over-retention.
- Detects datasets dormant for more than 24 months and computes their GDPR risk by crossing declared purpose, legal basis and applicable regulatory duration.
- Classifies each fonds against the EDPB grid and SIAF/National Archives reference frameworks to distinguish permanent public-interest archiving from ordinary regulatory retention.
- Generates automatically the deposit file for the Archives nationales du Luxembourg for eligible fonds, with prefilled ISAD(G) metadata.
- Alerts the DPO in real time when a retention period is exceeded without documented Article 89 justification.
- Produces a timestamped, cryptographically sealed PDF report, enforceable before the CNPD during an audit, evidencing the arbitration between minimisation and archiving for each data category.
- Proposes Article 89(1) safeguards (pseudonymisation, encryption at rest, access logging) with ready-to-deploy scripts on Azure Purview and AWS Macie.
Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS brick depending on your documentary perimeter. Request a tailored quote and our teams will prepare a demonstration on your real repositories, with a free 48h blank audit to measure your over-retention stock before any commitment.
