Skip to main content
Privacy Track
Category: Scope & Exemptions

Filing System

Also known as: Structured Filing System, Electronic Filing System
Simply put

A filing system is a structured way of arranging and keeping documents or records so they can be found and retrieved easily. It can be maintained electronically, for example on a computer, or physically in an office. The defining feature is that the information is organized according to a consistent method rather than stored at random.

Formal definition

A filing system is a structured method for organizing, storing, categorizing, and retrieving documents and records, whether held in electronic tools or in physical form, so that specific items can be accessed by reference to defined criteria. The evidence provided describes filing systems in a general organizational and information-management sense; it does not establish the specialized GDPR meaning of the term. Practitioners should note that under EU and UK data protection law 'filing system' is a defined concept with a narrower, structured-access requirement, and that meaning should be verified against the current official text of the Regulation rather than inferred from the general-purpose sources cited here.

Why it matters

The concept of a filing system is significant in data protection because it helps determine the material scope of the law. Under EU and UK data protection frameworks, the rules generally apply to personal data that is processed by automated means, and to personal data that forms part of, or is intended to form part of, a filing system. This means that structured manual (non-automated) records can fall within scope precisely because they are held in a filing system, whereas an unstructured, random collection of papers may not. Whether a given set of records qualifies is therefore a threshold question that can affect what obligations attach to the data.

The evidence digest cited here describes filing systems in a general information-management sense, arranging and keeping documents so they can be found and retrieved easily, whether electronically or physically. That general meaning is useful for understanding the everyday concept, but it is broader than the specialized definition used in data protection law. Under the Regulation, 'filing system' is a defined term with a narrower, structured-access requirement, and practitioners should not infer the legal meaning from general-purpose organizational sources. The precise wording and its interpretation should be verified against the current official text of the Regulation and relevant guidance.

Because the boundary between a qualifying structured filing system and an unstructured collection can be uncertain in practice, this distinction is frequently a point of assessment rather than a bright line. Regulators and courts may interpret the structured-access criterion in ways that vary by context, so organizations should treat borderline manual records with caution and document their reasoning rather than assume they fall outside scope.

Who it's relevant to

Data Protection Officers and Compliance Leads
DPOs and compliance teams need to assess whether manual and electronic record sets qualify as filing systems, because this determines whether the records fall within the material scope of data protection obligations. Given the potential for uncertainty at the borderline between structured and unstructured records, documenting the reasoning behind a scope determination is prudent.
Privacy and Data Protection Lawyers
Lawyers advising on scope should distinguish the everyday, general-purpose meaning of a filing system from the defined legal concept, which carries a narrower structured-access requirement. Because interpretation can vary by context and jurisdiction, advice should rest on the current official text of the Regulation and applicable guidance rather than general organizational definitions.
Records and Information Management Professionals
Those responsible for designing electronic tools and physical filing arrangements shape whether records are organized according to consistent, retrievable criteria. Their choices about categorization and structure can influence how records are characterized, so coordination with legal and compliance functions is generally advisable.
Engineers and System Designers
Teams building electronic filing systems implement the structured storage, categorization, and retrieval processes that make specific records accessible by defined criteria. Understanding that structure can affect legal characterization helps engineers work with privacy stakeholders when designing how personal data is stored and searched.

Inside Filing System

Structured set of personal data
A filing system, sometimes called a 'relevant filing system', refers to any structured set of personal data that is accessible according to specific criteria, whether centralised, decentralised, or dispersed on a functional or geographical basis. The structure is the defining feature rather than the medium.
Accessibility according to specific criteria
The set must allow personal data relating to a particular individual to be readily located by reference to criteria such as name, reference number, or another identifier. The concept turns on whether the data is organised so that information about a given data subject is accessible without disproportionate effort.
Manual and non-automated records
The filing system concept is particularly significant for manual (paper-based) records. The GDPR generally applies to processing by automated means and to the processing other than by automated means of personal data which forms part of, or is intended to form part of, a filing system.
Relevance to material scope
The concept operates as a gateway to material scope: unstructured manual data that does not form part of, and is not intended to form part of, a filing system generally falls outside the Regulation, whereas structured manual records within a filing system are typically caught.

Common questions

Answers to the questions practitioners most commonly ask about Filing System.

Does the concept of a filing system only apply to digital or electronic records?
No. A filing system is not limited to electronic processing. The GDPR's material scope generally extends to the processing of personal data by automated means and also to personal data that forms part of, or is intended to form part of, a filing system where processing is non-automated. This means structured manual or paper-based records can fall within the concept, provided they meet the structuring criterion. The key question is not the medium but whether the records are organized so that specific information relating to an individual is readily accessible.
Is any collection of documents containing personal data automatically a filing system?
Not necessarily. A mere accumulation of documents is generally not a filing system on its own. The defining feature is that the set of personal data is structured according to specific criteria, such that data relating to a particular individual can be found without disproportionate effort. Unstructured, disorganized files that would require searching through everything to locate a person's data typically fall outside the concept. Where the boundary lies in a given case can be a matter of assessment, and interpretations of what counts as sufficiently structured may vary.
How do we assess whether our manual records meet the structuring criterion?
The practical test generally focuses on accessibility: are the records organized by criteria (for example, by name, reference number, date, or category) that allow personal data about a specific individual to be retrieved without disproportionate effort? You should document the indexing or ordering logic applied to the records. Where records are only loosely grouped, consider whether a reasonable person could locate an individual's data through the applied structure. Because this is a fact-specific assessment, it is advisable to record your reasoning rather than assume a fixed rule applies.
What should we do with manual records that fall within a filing system for data subject rights requests?
If manual records form part of a filing system, the personal data within them is generally subject to the same data subject rights that apply to other in-scope processing, including rights of access. In practice this means your response procedures should account for structured paper or manual files, not only electronic systems, when searching for a data subject's personal data. Where records fall outside a filing system, they may not attract the same obligations, so identifying which records are in scope is a useful first step. Verify the precise scope of applicable rights against the current official text.
How does the filing system concept affect our record-keeping and mapping activities?
When mapping processing activities, it is prudent to identify structured manual records alongside electronic systems, since both may be in scope. This supports accurate documentation of where personal data is held and how it is organized. Recording the structuring criteria for each set of manual records helps demonstrate why records are treated as in or out of scope and supports consistent handling for access, retention, and security measures. The appropriate level of detail should be proportionate to the nature and volume of the records involved.
What security and retention considerations apply to personal data in a manual filing system?
Personal data within a filing system is generally subject to the same core principles that apply to other in-scope processing, including appropriate security and defined retention. In practice this may translate into physical safeguards such as controlled access, secure storage, and disposal procedures for paper records, rather than technical measures alone. Retention periods should be applied to manual files consistently with the criteria used for equivalent electronic data. Because appropriate measures are risk- and context-dependent, the specific controls should be determined through your own assessment.

Common misconceptions

The GDPR only applies to computerised or digital records, so paper files are always out of scope.
The Regulation generally applies to non-automated processing of personal data where the data forms part of, or is intended to form part of, a filing system. Structured paper records organised so that an individual's data is accessible according to specific criteria can therefore fall within scope.
Any collection of documents that happens to contain personal data is a filing system.
A filing system typically requires the data to be structured and accessible according to specific criteria. A disorganised or unstructured set of manual records from which information about a specific person cannot readily be located may not meet the definition, though this is a fact-specific assessment and the boundary can be uncertain in practice.
A filing system must be held in one central location to qualify.
The definition expressly contemplates sets that are centralised, decentralised, or dispersed on a functional or geographical basis. Distribution across locations does not by itself take a structured set outside the concept.

Best practices

Assess whether manual and paper-based records are organised so that an individual's data is accessible according to specific criteria, and document the reasoning, since the classification is fact-specific and can be contested.
Do not assume paper records are automatically out of scope; treat structured manual files as potentially within material scope and subject them to the same governance analysis as electronic records.
Include decentralised and geographically dispersed record sets in your assessment, as distribution across locations does not by itself remove a set from the filing system concept.
Maintain records of processing that reflect both automated systems and any qualifying manual filing systems, so that scope decisions are transparent and reviewable.
Where it is unclear whether a set of records meets the criteria, seek a documented internal or legal assessment rather than defaulting to either inclusion or exclusion, and revisit the position if the structure of the records changes.
Verify the precise scope wording and any national implementing provisions against the current official text, as member state law and UK GDPR provisions may affect how manual and unstructured data are treated.