The classic trap
Recital 160 traps historical research and genealogy actors who believe they fall outside the GDPR because they handle old archives. CNPD and CNIL regularly remind that as soon as a single living person appears in a family tree, an archive collection or a historical study, the GDPR applies in full. The reverse trap also exists: believing that all data from a 19th-century parish register is free to use, when in fact it reveals the ancestry of individuals alive today, and therefore constitutes indirect personal data about them.
The practical test: who is alive in your corpus?
- Data of deceased persons falls outside the GDPR (unless specific national law applies, see Article 85 and post-mortem rights in France).
- Data of living persons mentioned in the same document (descendants, surviving spouses, witnesses still alive) remains fully protected.
- Data indirectly revealing information about living persons (ancestor genetics, hereditary pathologies, contested filiation) constitutes personal data of the living descendants.
- Article 89 GDPR opens derogations for research, but requires appropriate safeguards: minimisation, pseudonymisation, access restriction, documented purpose.
- In Luxembourg, the law of 17 August 2018 on archiving and the law of 1 August 2018 on data protection govern access to public historical archives.
The documentary reflex
A historical or genealogical research project must produce a complete GDPR file before starting: legal basis (public interest Article 6(1)(e) or legitimate interest Article 6(1)(f)), Article 9 analysis for sensitive data (health, religion, political opinions from archives), DPIA for large-scale processing, Article 30 register, and differentiated retention policy for living vs deceased persons.
How Luxgap automates this risk
Our Luxgap Research Compliance Vault transforms an archive corpus or historical dataset into a controlled GDPR perimeter, without slowing down the work of researchers and genealogists. The tool ingests your document collections (digitised civil status registers, exported genealogy databases such as Geneanet or MyHeritage, notarial archives, historical medical files) and automatically applies an AI classification engine that distinguishes presumed deceased persons from potentially living persons by cross-referencing dates of birth, INSEE death registries and life-expectancy rules by cohort and country.
- Classifies every individual mentioned in the corpus into three categories (confirmed deceased, probably living, uncertain status) with a confidence score and an opposable justification.
- Automatically pseudonymises living persons according to the ISO 25237 standard while preserving relational coherence for family trees and cohort analyses.
- Generates the pre-filled Article 35 DPIA and the Article 30 register specific to historical research, with documented Article 89 GDPR legal basis.
- Detects Article 9 sensitive data hidden in the archives (mentions of illnesses, political opinions during the Occupation, criminal convictions) and applies the appropriate reinforced legal regime.
- Produces a cryptographically sealed admissibility report, opposable to the CNPD or to the Luxembourg National Archives during an inspection or a derogatory access request.
- Alerts in real time when an access or rectification request concerns a living person present in your corpus, and pre-drafts the reasoned Article 89(2) response.
Available as a complement to a Luxgap DPO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on a sample of your real corpus, with a free white audit within 48h to measure your exposure before any commitment.
