# GDPR Article 89 — Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes > The research-and-archiving carve-out that lets datasets like ours preserve historical observations under appropriate safeguards, even when other rights would otherwise apply. Citation: *Regulation (EU) 2016/679* Last reconciled with canonical source: 2026-04-25 Canonical: https://eur-lex.europa.eu/eli/reg/2016/679/oj Source: https://consenttheater.org/law/gdpr/art-89/ --- ## In plain language Article 89 is the doorway through which research projects, archives, and statistical institutions can keep doing what they do without colliding with every individual data-subject right in Chapter III of the GDPR. The deal is simple: **if you process personal data for archiving in the public interest, scientific or historical research, or statistical purposes — and you have appropriate safeguards in place — Member States may exempt you from a number of otherwise-binding obligations.** What "appropriate safeguards" means in practice: - Technical and organisational measures to ensure data minimisation. - Pseudonymisation where the research goal can be reached that way. - Aggregation or anonymisation when individual identification is no longer required. - Restricted access; clear governance. Article 89 is the legal anchor for the Internet Archive, library digitisation programmes, academic datasets, and projects like the planned ConsentTheater snapshots archive. It does **not** give a free pass — derogations are conditional on the safeguards being demonstrably in place — but it permits historical records to survive an Article 17 erasure request when erasure would "render impossible or seriously impair" the achievement of the research/archiving goal. **UK:** Article 89 of the [UK GDPR](/law/uk-gdpr-and-pecr/) carries the same safeguards regime, and Schedule 2 of the Data Protection Act 2018 makes the corresponding domestic-law derogations. ## How we use this on consenttheater.org - The append-only git history of the planned [snapshots dataset](https://github.com/ConsentTheater/server) is justified under Article 89 in conjunction with [Article 17(3)(d)](/law/gdpr/art-17/) — historical scans remain in the chain because rewriting them would defeat the integrity of the research archive. - Even with this anchor, our snapshots policy provides for cessation of *active* scanning on substantiated takedown requests, and for visible correction of any factually erroneous record. That is the kind of safeguard Article 89(1) requires. ## Original text Reproduced verbatim from *Regulation (EU) 2016/679*, published by the Publications Office of the European Union on [eur-lex.europa.eu](https://eur-lex.europa.eu/eli/reg/2016/679/oj). The official source is authoritative; this rendering is a navigation convenience. > **1.** Processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of the data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in order to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided that those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which does not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner. > > **2.** Where personal data are processed for scientific or historical research purposes or statistical purposes, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. > > **3.** Where personal data are processed for archiving purposes in the public interest, Union or Member State law may provide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those purposes. > > **4.** Where processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall apply only to processing for the purposes referred to in those paragraphs. Prefer the canonical version? [Open this article on eur-lex.europa.eu →](https://eur-lex.europa.eu/eli/reg/2016/679/oj) --- ## Reproduction notice The text reproduced on this page is taken from the consolidated version of *Regulation (EU) 2016/679*, an official act of the European Union. EU legislative texts are excluded from copyright protection (recital 22 of Directive (EU) 2019/790). ConsentTheater is not affiliated with, endorsed by, or sponsored by any EU institution. For binding legal use always consult the official source on [eur-lex.europa.eu](https://eur-lex.europa.eu/eli/reg/2016/679/oj). We re-verify each reproduction against the canonical text on the date shown at the top of this page.