Come and see us in person to undertake research on our site. To prepare for your visit and learn about our Covid-secure measures please see here 

May - June half term holidays opening

Gloucestershire Heritage Hub will be open as usual on Tuesday 31st May and Wednesday 1st June, but will be closed on Thursday 2nd and Friday 3rd June in line with the Platinum Jubilee Bank Holidays.

Collections Management Training

Online Collections Management training

How to preserve your community or family archive

Advice on how to manage and organise your archive

Collections Management 4: data protection legislation


Want to learn more about data protection?

Need to understand how it relates to your community collection?


The Data Protection Act was passed in 1998 and updated in 2018. It is a national law which is based on the European Union’s General Data Protection Regulation (GDPR).

The Act gives people certain rights regarding information held about them. And it protects these rights in respect of the processing of a person’s personal data. "Personal data" means any information relating to an identifiable living person who can be directly or indirectly identified. The term "processing" is very broad and includes the obtaining, recording, holding, altering and destruction of data.

So, what does this mean for you and your collection? You will need to think about data protection and access in relation to:

  • any personal details you may have collected for members and supporters of your group
  • any personal data contained in the records in your collection

The first of these is an issue faced by many groups and is not unique to archive or local history/heritage groups. You can find information and guidance from:


Here, we’ll focus on personal data contained in the records in your collection.


Data protection only relates to living individuals. This means that documents older than 100 years are out of scope, as are documents less than 100 years old but relating to people you know to be dead. However, do remember that relatives, friends or neighbours may have on-going sensitivities, especially in small or close- knit communities. This means that there may be ethical, if not legal, considerations about your group gathering and sharing certain records. You should aim to identify this at the time of accessioning.

But what about records which are in scope, because they do contain personal data about living individuals? Data protection legislation recognises that there is a public interest in permitting the permanent preservation of personal data for the long-term benefit of society. There are two relevant exemptions to the Act which make it legitimate for your group to preserve records containing personal data and let other people see them:

• archiving in the public interest by public, private or voluntary bodies
• access for historical research, providing certain conditions are met [1]:

  • the research must not be carried out to inform measures or decisions relating to an individual (unless the purposes for which the processing is necessary such as approved medical research).
  • the research must not be likely to cause substantial damage or distress to the individual.

It is good practice to remind people of their responsibilities to uphold these conditions for example by displaying a notice and/or asking people to sign a form before they can look at certain documents. You can see some sample text below:

Finally, remember that as a community group, you are not obliged to:

  • accept into your collections every document which you are offered
  • make every document you look after accessible to other people

You may decide as a group that you will not look after recent documents which contain personal data and cannot be straightforwardly shared with others. Or you may decide to let people see only certain records. Larger organisations will usually address such issues through a specific access policy. You may choose to incorporate your decisions on access into an over-arching collecting policy.
Although this can feel like a complicated and daunting area, Information Commissioner Elizabeth Denham, herself a former archivist, has been at pains to state that “data protection …..does not prevent archiving, it supports it.” [2]

[1] Section 19 of the Data Protection Act 2018

[2] Quote from foreword to The National Archives Guide to Archiving Personal Data


You can find more information from the following links:

Page updated: 23/11/2020 Page updated by: Ally McConnell

Help us improve Heritage hub

Don’t include personal or financial information like your National Insurance number or credit card details.