Data-protection principles are the backbone of every modern privacy regime. They are deliberately technology-neutral so that they apply equally to a paper accession register, a museum CRM and an AI-driven cataloguing pipeline. Master the principles and you can reason about almost any new situation without waiting for a rule that names it.

The canonical formulation is GDPR Article 5, but the same ideas appear in the OECD Privacy Guidelines, Convention 108+ and Fair Information Practice Principles - so they are genuinely international.

The core principles

  • Lawfulness, fairness & transparency - you need a valid legal basis and people must understand what you do with their data.
  • Purpose limitation - collect for a specified purpose; don't quietly repurpose. Archiving in the public interest is a recognised compatible purpose under GDPR Article 89.
  • Data minimisation - hold only what the purpose requires.
  • Accuracy - keep data correct and current, with correction routes.
  • Storage limitation - don't keep identifiable data longer than needed (with an archiving exemption).
  • Integrity & confidentiality - protect against loss and unauthorised access, the bridge to ISO/IEC 27001.
  • Accountability - you must be able to demonstrate compliance, not merely assert it.

Legal bases and special categories

Processing needs a lawful basis - consent, contract, legal obligation, vital interests, public task or legitimate interests. Consent is often the weakest choice for heritage bodies because it can be withdrawn; public task or legitimate interests usually fit archival work better. Special-category data (health, ethnicity, religion, biometrics, sexual life) needs an additional Article 9 condition, which matters constantly for personal papers and community collections.

In practice. Record your lawful basis and any Article 9 condition at the point of accession, in the descriptive metadata (a Dublin Core rights or an EAD accessrestrict note). Deciding it years later, when a request arrives, is far harder and rarely defensible.

Key takeaways

  • Seven GDPR principles - lawfulness through accountability - apply to any format and mirror OECD and Convention 108+ norms.
  • Archiving in the public interest gives lawful reuse and relief from strict storage limitation under Article 89.
  • Special-category data needs an extra Article 9 condition; capture the basis at accession, not on demand.

Check your understanding

Last modified: Saturday, 1 August 2026, 10:37 AM