Category: Data Lifecycle and Disposal

Data Archiving

Also known as: Data Archival

Simply put

Data archiving is the practice of identifying data that is no longer actively used and moving it out of production systems into separate, long-term storage. The goal is to preserve information that remains important for retention or reference purposes while keeping active systems lighter and less cluttered. Archived data is typically accessed infrequently, if at all, but is retained because it still matters to the organization.

Formal definition

Data archiving is the process of identifying inactive or historical data and relocating it from production systems into a dedicated long-term storage tier for retention. Distinct from backup (which creates recoverable copies of active data), archiving moves data out of primary systems for durable preservation, and archived data is generally optimized for infrequent access rather than frequent modification. In some implementations, archiving mechanisms also capture and manage changes to data over time to support historical analysis. This definition addresses the storage and lifecycle concept only; it does not cover jurisdiction-specific retention periods, lawful retention obligations, deletion or disposal requirements, cross-border transfer controls, or the security controls applied to archived stores, each of which must be determined by applicable law, policy, and implementation context. Archiving personal data does not remove it from the scope of applicable data protection obligations.

Why it matters

Data archiving matters because production systems accumulate large volumes of inactive or historical data over time, and retaining that data in primary systems increases cost, complexity, and management overhead. By moving data that is no longer actively used into a dedicated long-term storage tier, organizations can keep active systems lighter while preserving information that remains important for retention or reference. This supports both operational efficiency and the organization's ability to retain information it still considers valuable.

From an information governance perspective, archiving is a lifecycle activity that intersects with, but does not by itself satisfy, retention and disposal requirements. Archiving personal data does not remove it from the scope of applicable data protection obligations; archived personal data generally remains personal data and continues to be subject to the same accountability, security, and lawful-basis considerations as data held in production. Organizations should not treat the act of archiving as equivalent to compliance with retention law, and separate policy and legal analysis is needed to determine how long data may or must be kept.

Archiving is also distinct from backup, and conflating the two can create governance gaps. Backup creates recoverable copies of active data to guard against loss, while archiving moves data out of primary systems for durable, long-term preservation of information that is accessed infrequently. Treating an archive as a backup, or a backup as an archive, can lead to incorrect assumptions about recoverability, retention, and the controls that should apply to each store.

Who it's relevant to

Information Governance and Records Leads

Those responsible for data lifecycle, retention, and stewardship need to distinguish archiving as a storage and lifecycle activity from the legal and policy questions of how long data should be kept and when it must be disposed of. Archiving supports retention but does not by itself establish or satisfy retention obligations, which must be defined by policy and applicable law.

Data Protection and Privacy Professionals

DPOs and privacy practitioners should note that moving personal data into an archive does not take it out of the scope of applicable data protection obligations. Archived personal data generally remains personal data, so considerations such as lawful basis, security, and accountability continue to apply and require ongoing management rather than being resolved by the archiving step itself.

Data and Storage Architects

Teams designing storage tiers and platforms are relevant because archiving involves relocating inactive data into dedicated long-term storage optimized for infrequent access. They must also keep the archive distinct from backup, since the two serve different purposes and carry different expectations for recoverability, retention, and access.

Compliance and Legal Teams

Compliance and legal stakeholders are responsible for determining the retention periods, disposal requirements, cross-border transfer controls, and other obligations that this storage concept does not itself address. Their input is needed to ensure that what is archived, for how long, and under what controls aligns with applicable law and organizational policy.

Inside Data Archiving

Retention-Driven Movement

Data archiving is the process of moving data that is no longer in active use to separate, typically lower-cost storage while retaining it for a defined period. The retention period is generally driven by legal, regulatory, contractual, or business requirements rather than by storage convenience alone.

Distinction from Backup

Archiving differs from backup. A backup is a copy of active data maintained for recovery in case of loss or corruption, while an archive is typically the authoritative or sole remaining copy of inactive data retained for long-term reference or compliance. Treating an archive as a backup, or vice versa, can create gaps in both recovery and retention.

Retention and Disposal Policy

Archiving should operate under a defined retention schedule that specifies how long categories of data are kept and when they are securely disposed of. Where personal data is involved, retention limits are relevant considerations under regimes such as the EU GDPR and UK GDPR, though the specific obligations and permissible periods vary by jurisdiction and processing context.

Governance Elements

Archiving sits within data governance and typically involves ownership and stewardship of archived records, cataloging and lineage so archived data can be located and understood, and documented policy. Demonstrable evidence of these controls supports accountability under governance frameworks.

Security Controls for Archives

Because archived data may persist for long periods, information security controls covering confidentiality, integrity, and availability remain applicable. This can include access restrictions, integrity verification, and protection of the storage medium, distinct from the governance-level retention decisions.

Personal Data in Archives

Where an archive contains personal data, that data generally remains personal data and stays within the scope of applicable data protection law for as long as it is retained. Archiving does not by itself remove data subject rights or controller and processor obligations, though those obligations differ across regimes.

Common questions

Answers to the questions practitioners most commonly ask about Data Archiving.

Does archiving personal data remove it from the scope of data protection obligations?

No. Archived personal data generally remains personal data and stays within the scope of applicable regimes such as the EU GDPR, UK GDPR, or CCPA and CPRA. Moving records to an archive changes how and where they are stored, but it does not extinguish obligations relating to lawful basis, retention limits, security, or data subject rights. Anonymization to an irreversible standard could take data out of scope, but archiving alone does not achieve that, and encryption or tokenization applied to an archive does not make the underlying data non-personal.

Is data archiving the same as data backup?

No, although the two are frequently conflated. A backup is typically a copy retained for recovery and operational continuity, restoring systems to a prior state after loss or corruption. An archive is generally the retention of records that are no longer in active use but must be kept for defined business, legal, or regulatory reasons. Backups tend to be short-lived and overwritten on a cycle, while archives are governed by defined retention rules. The two serve different purposes and are usually governed by separate policies.

How should retention periods be determined for archived data?

Retention periods should generally be derived from documented business, legal, and regulatory requirements rather than set arbitrarily or defaulted to indefinite. Under most regimes, storage limitation principles expect personal data to be kept no longer than necessary for the stated purposes. This entry does not enumerate specific statutory retention durations, which vary by jurisdiction, sector, and record type, so retention schedules should be established with reference to the applicable rules and, where relevant, legal advice.

How can data subject access and erasure requests be handled for archived records?

Archives should generally be designed so that records remain discoverable and actionable for the purposes of rights requests, since archiving does not suspend those rights in most regimes. In practice this means maintaining indexing, search, and retrieval capability across archived stores, and defining how a right to erasure request interacts with any overriding retention obligation. Where an exemption or legal obligation to retain applies, that should be documented as the basis for declining or limiting a request rather than assumed.

What governance controls support a defensible archiving program?

Defensible archiving typically draws on both governance and security disciplines. On the governance side this generally includes defined ownership and stewardship, a retention schedule, data lineage and cataloging so archived records remain locatable, and documented policy. On the security side it includes confidentiality, integrity, and availability controls appropriate to the sensitivity of the data. Accountability under governance frameworks requires demonstrable evidence of these controls, not merely a stated intent to archive responsibly.

How should archiving interact with the eventual disposal of records?

Archiving and disposal are generally two ends of the same lifecycle. An archive without a defined end-of-life process tends to accumulate data beyond its justified retention period, which can conflict with storage limitation expectations. Programs typically define triggers for review and secure disposal once retention requirements lapse and no legal hold applies. This entry does not cover the mechanics of legal hold, cross-border transfer of archived data, or specific destruction standards, which should be addressed separately.

Common misconceptions

Archiving is the same as taking a backup.

They serve different purposes. A backup is a recovery copy of active data, while an archive typically holds inactive data as the authoritative or sole retained copy for compliance or reference. Relying on one to perform the function of the other can leave gaps in both recovery and retention.

Once data is archived it is out of scope for data protection obligations.

If an archive contains personal data, that data generally remains personal data and stays within the scope of applicable regimes such as the EU GDPR or UK GDPR for as long as it is retained. Applying pseudonymization does not remove it from scope, and treatment differs across jurisdictions.

Archived data can be kept indefinitely because it is no longer in active use.

Retention should be governed by a defined schedule tied to legal, regulatory, contractual, or business requirements. Indefinite retention of personal data can conflict with storage-limitation expectations in many data protection regimes, and secure disposal at end of the retention period is part of the archiving lifecycle.

Best practices

Define a documented retention schedule that specifies retention periods and disposal triggers for each category of archived data, and record the legal, regulatory, contractual, or business basis for each.

Maintain clear ownership and stewardship for archived data, and catalog it with lineage information so archived records can be located, understood, and produced when required.

Keep archiving distinct from backup in both design and documentation, ensuring recovery copies and long-term retained copies are managed under separate purposes and controls.

Apply appropriate confidentiality, integrity, and availability controls to archives given their long lifespan, including access restrictions and integrity verification of retained records.

Where archives contain personal data, treat that data as remaining in scope of applicable data protection law, preserve the ability to honor data subject rights, and confirm requirements against the specific jurisdiction rather than assuming a single regime applies.

Retain demonstrable evidence of retention decisions, disposal actions, and access controls to support accountability, rather than relying on stated policy alone.