Filing System (Article 4(6) GDPR)

Article 4(6) GDPR defines the filing system as any structured set of personal data which are accessible according to specific criteria, whether centralized, decentralized or dispersed on a functional or geographical basis. In practice, the concept is relevant above all in the case of manual, non-automated processing: only if the data are stored or intended to be stored in a filing system does such processing fall within the scope of the GDPR at all (Article 2(1) GDPR).

1. Overview

1.1 Significance of the concept

The filing system is one of the central connecting factors for the material scope of the GDPR. In the case of fully automated processing, the Regulation always applies, without the existence of a filing system being relevant. In the case of non-automated, that is, manual processing, by contrast, the filing system is the decisive hurdle: if there is no structured set within the meaning of Article 4(6) GDPR, the processing does not fall within data protection law.

In practical terms, this means: unstructured handwritten notes, unsorted stacks of paper, or filing collections created according to no comprehensible criterion are excluded from the scope of protection. However, as soon as a systematic structure is discernible that permits specific data to be found, the threshold is crossed.

1.2 Legislative history and predecessor law

In substance, the concept ties in with Article 2(c) of the former Data Protection Directive 95/46/EC, which still referred to a "file". The GDPR slightly adjusted the terminology but essentially retained the substantive content.

2. Requirements of the filing system

2.1 Structured set

The core characteristic is structure: the data must be ordered according to criteria that enable targeted access to individual records or specific categories of data. The criterion for ordering may relate to a person (name, date of birth, personnel number, address) or to a subject matter, provided that it ultimately permits the retrieval of data relating to specific individuals (e.g. file reference, vehicle registration number, job title, region).

Purely subject-related characteristics that do not establish any link to a natural person, by contrast, are not sufficient.

2.2 Uniform structure as an indicator

In the case of sets of files, the uniform design is the decisive indicator. If files are structured uniformly according to their external labeling, e.g. following the pattern of surname, first name, personnel number, a filing system will as a rule already exist. The decisive factor is that the uniform structure facilitates the retrieval and finding of data.

This also applies to files organized by subject area, person, or customer, as well as to uniformly structured forms and case files.

2.3 No minimum number required

The existence of a filing system does not require any minimum number of data subjects, files, or records. Even two case files stored in a structured manner may suffice. The decisive factor is solely the manner of organization, not the size of the set.

3. Distinction: filing system or not?

The following table summarizes typical examples:

4. Scope: manual and handwritten sets included

The concept expressly covers both forms: analog sets on paper and digital sets. Card indexes, e.g. for patients or customers, always constitute a filing system.

Handwritten records may also fall within the scope. What matters is whether the content can be easily accessed and the individual data can be found without disproportionate effort. The CJEU has clarified in this respect that neither a specific register system nor a formalized filing arrangement is required; it is sufficient if the data are retrievable on the basis of specific criteria (CJEU, judgment of 10 July 2018, C-25/17, Jehovah's Witnesses).

5. Relationship to manual processing and the scope of the GDPR

The main practical application of the concept lies in the distinction: the GDPR applies to manual processing operations only if the data are stored or intended to be stored in a filing system (Article 2(1) GDPR). If this requirement is not met, the activity lies, in legal terms, outside the regulatory scope of data protection law.

The filing system thus constitutes both a protection gap and a systemic boundary: the legislature deliberately decided not to cover purely unstructured manual activities, because the effort associated with the GDPR would be disproportionate for such situations. However, anyone who collects personal data even merely with the aim of subsequently making them accessible in an ordered set already falls within the scope.