What the Data Protection Act asks of your paper archive

The Data Protection Act, 2019 is often read as a technology obligation, which leads institutions to audit their systems and stop there. The Act governs personal data irrespective of the medium it sits in. A filing room holding member files, personnel records or beneficiary registrations is squarely within scope, and it is usually the part of the estate nobody has mapped.

That matters because most of the Act's requirements assume you can answer basic questions: what personal data do you hold, why do you hold it, on what lawful basis, who can reach it, and how long will you keep it. For digital systems those answers can be reconstructed. For twenty years of boxed paper, they generally cannot — not without an appraisal exercise.

The practical sequence is therefore appraisal before conversion. Survey what the archive actually contains, identify which record classes hold personal data, establish the retention period each class is subject to, and separate what is already past retention. It is common for a meaningful share of an archive to be destroyable immediately, which reduces both the digitization bill and the compliance exposure.

Only then does scanning make sense. Digitizing an unappraised archive converts a paper problem into a searchable digital one — and a searchable repository of personal data you have no lawful basis to retain is a worse position than the boxes were, because now it is trivially accessible.