4 Archaeological archives and personal/sensitive data

4.1 Is your data personal or sensitive (or both)?¶

Personal data is any information that relates to an identifiable living individual. It does not have to be a direct identifier like a name, but it can be a combination of data, such as initials and a job title, that allows an individual to be identified. Data that starts out as non-personal can also become personal when combined with other publicly available information, so careful data management and planning are essential.

Sensitive personal data (or special category data) is personal data that has further legal protections due to the higher potential for harm to the individual if misused. This includes information on race and ethnicity, genetic, biometric (where used for identification) and health data, information on an individual’s political, religious or philosophical beliefs and opinions, data on trade union membership, and information on sex life or orientation.

A piece of personal data that is not inherently sensitive can become sensitive data when linked with other data. For example, the name of an individual when linked with a cultural or religious site can together be considered sensitive data.

In archaeological research, personal and/or sensitive data can be found in a variety of sources (both digital and documentary), for example:

• Organisational administration records

  • This category can include employee CVs, performance details, criminal record data, health records, contact information and next of kin, qualifications, licences and certifications, staff schedules, letters and correspondence, and finance details.

• Project administration records

  • This category may include similar data to above, such as employee certifications, staff contact and schedule details, project financial information, but it may also include records relating to landowners and other project stakeholders where personal and sensitive data can be found such as, legal contracts, letters and correspondence.

• Public and community engagement data

  • This category may include personal or sensitive data in participant contact records, survey data, ethnographic records, oral histories, videos, and photographs.

• Fieldwork and specialist records

  • This category can include personal or sensitive data purposefully recorded in context sheets, site diaries, photographs, video, databases and spreadsheets, but can also include personal data that may have been inadvertently captured.

• Geospatial data

  • Co-ordinates of private residences or other locational data that can lead to identifying an individual can be classified as personal data.

• Human remains and burial data

  • While only living individuals are protected by GDPR, archaeological data can constitute sensitive personal data when it can be linked to living individuals, such as descendants. This could be through genetic data or through individuals mentioned in memorials.

• Reporting and archive data

  • This category can include a combination of the data listed above.

The list above provides examples of the most common sources of personal and sensitive data. It is not a definitive list and should only be used as a prompt when assessing your own data. In doing so, it should also be borne in mind that effectively all archaeological data may contain personal data.

The diversity of personal data sources in archaeological records highlights the complexity of the challenge and it can often be difficult to disentangle personal data from other data in an archival context. However, it is personal information that often makes an archaeological archive valuable and engaging for future users. With responsible stewardship most archaeological data can be shared, provided personal and sensitive data is managed proactively and processed in a way that is adequate, relevant and respectful to the rights of the individuals involved.

4.2 Why do we need personal data in archaeology?¶

Recent empirical studies, such as those conducted by the TETRARCHs project, have demonstrated a critical link between personal data and the reuse of this data in archaeology. Taking archaeological photographs as an example of a typical data form, research from the TETRARCHs project shows that photos that include people are reused more than any other form of photo, including by archaeological and heritage specialists themselves. In contrast, stratigraphy photos without any overt human presence in them are hardly reused at all, despite their prevalence in archaeological records. Attention must therefore be given both to including necessary technical data (e.g., stratigraphy photos) in archives to enable future analysis, and to including experiential data that reflect the full practices and people of archaeology.

In related TETRARCHs experiments with other forms of archaeological data beyond photographs (e.g., reports, exhibition outputs, etc.), similar findings are evident across multiple user groups, including archaeologists, students, creative practitioners, memory institution professionals, and community members. The findings are stark: datasets need to be humanised to ensure they are used again by others. That is, they must represent human emotions, sensations, actions, moods, lived experiences, as well as include literal signifiers of humans in photos, illustrations, audio, video and other creations.

4.3 Do we need to eliminate all personal data from archaeological archives?¶

Data protection regulations are intended to give people control over the data that relates to them, such that their own ‘humanised’ data is used, forgotten or otherwise engaged with on terms that they define through the giving of explicit consent. However, as various commentators have noted e.g. Maeckelbergh, 2021, GDPR was not designed with research in mind, and institutional processes for securing consent tend to err on the side of demanding complete or near-complete anonymity and non-disclosure of personal data. Yet this non-disclosure bias contradicts the evidence: people are prepared to share - even if it discloses their identity - if it is to be used for work that is of interest to them (Class et al. (2021) citing Jones et al. 2018). As some argue, the right to be forgotten should sit alongside one’s right to be remembered Roued-Cunliffe, 2019.

4.4 What are the consequences of eliminating personal data from archaeological archives?¶

In formal conversation with representatives of development-led archaeological services across the UK, practitioners describe how archaeological data collected in the course of excavation and post-excavation is generally split from data used in social media and public engagement (see quotes below derived from a TETRARCHs consultative workshop in Spring 2025). As a result, human details are generally eliminated from the archaeological record, while those retained for social media/public engagement may simply be deleted or lost after use. Moreover, the scale of some commercial archaeological operations, including joint ventures, is such that the consent requirements of GDPR can seem overwhelming. It is often difficult to stay abreast of changing staff while also managing access to consent forms to verify data protection requests.

Yet, there is consensus that existing guidance needs to be brought together to deal with personal data in more unified and nuanced ways. The personal stories that provide context to archaeological data, and the institutional stories that document professional change, are key to the meaningfulness of our disciplinary records. Steps must be taken to respect their inclusion in our archives.

“...we’re losing an awful lot of the character of the site...It just becomes a very cold archive...But I think that there is no education on this. There is no thought process about it. It’s not of interest other than from the social media aspect and the outreach team, who are also disconnected...”

“the bit of the archive that is safe to deposit, the nuts and bolts of all the features you’ve uncovered, all the artefacts, etc, all those forms we fill out [are] probably the least used of any archaeological data. It’s the high level stuff. It’s the photos, the people...the photos of the trench with everyone working in it that people want to use.”

“I think our issue is...a cultural one of understanding where we are on that spectrum from very technical, sterile professional data...that is beautifully interoperable and can be easily found through to there not being any people left anymore.”

“Those boxes that I’m...sorting...are full of people absolutely full to bursting of people, of driver’s licenses, of photographs, of who hired what? Who stayed in what hotel? Who worked on which project...that is their key. That is their memory of their institution...I don’t know if we realise quite what we’re missing because we haven’t got to that point of needing to solve those issues yet...”

(Quotes provided by archaeological professionals from across the UK who are responsible for data collection, management and archiving. This information was collected at a TETRARCHs workshop in Spring 2025 about experiences with personal data in archaeology. As evidenced in the quotes, professionals overwhelmingly identify the loss and a perceived lack of awareness of the implications of stripping personal data from archaeological archives.)