[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDxQSGX20sHu-aY2ahqiTE9fA9EkDg0PJ-PCx5K46VPo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":43},"72efd9fb-0c87-43c7-b7e9-001934a40f1d","cjeu-rules-physical-church-baptismal-registers-fall-under-gdpr","da40e340-9622-424d-832c-f866909cebfd","CJEU Rules Physical Church Baptismal Registers Fall Under GDPR","The CJEU Advocate General's opinion confirms that GDPR applies not only to digital systems but also to manual filing systems, including physical records like church baptismal registers, as long as they are structured to allow retrieval of personal data. This ruling matters because many organizations assume GDPR obligations are limited to electronic data processing, leaving physical records ungoverned and non-compliant. The opinion also clarifies the right to erasure in non-digital contexts, requiring organizations to consider what 'erasure' meaningfully looks like when deletion of a physical record is not straightforward. Exceptions for archiving and historical research add nuance, but do not exempt organizations from establishing lawful bases and documented justifications for retaining such data.","**Immediate actions:**\n- Audit all manual and physical filing systems to determine whether they constitute GDPR-covered filing systems under the structured retrieval test.\n- Review existing privacy notices and data subject rights procedures to ensure they explicitly cover physical and manual records, not just digital ones.\n\n**Long-term improvements:**\n- Establish a formal Data Protection Impact Assessment (DPIA) process that includes physical record systems, registers, and archives.\n- Define and document a clear organizational policy for handling right-to-erasure requests against physical records, including partial redaction or annotation procedures.\n- Train records managers, archivists, and administrative staff on GDPR obligations applicable to non-digital data processing.\n\n**Detection & Compliance measures:**\n- Maintain a comprehensive Record of Processing Activities (RoPA) that inventories both digital and physical data processing activities.\n- Schedule periodic compliance reviews to incorporate evolving CJEU and national supervisory authority guidance on manual filing systems.",[12,13,14,15,16,17,18,19,20],"GDPR Article 2 (Material Scope)","GDPR Article 4(6) (Definition of Filing System)","GDPR Article 17 (Right to Erasure)","GDPR Article 89 (Archiving & Research Exceptions)","GDPR Article 30 (Records of Processing Activities)","NIST Privacy Framework PR.DS-P (Data Processing Policies)","CIS Control 3 (Data Protection)","ISO\u002FIEC 27001:2022 Annex A 5.33 (Protection of Records)","ITIL Service Design – Information Security Management",{},"published","2026-10-06T08:20:21.489652+00:00","2026-10-06T08:20:21.201+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=CJEU_-_C-12\u002F25&diff=53294&oldid=53293","cjeu-c-12-25-81d9e7","CJEU - C-12\u002F25",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]