Filing system
A filing system means any structured set of personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis (Art. 4(6) GDPR).
The concept determines the material scope of the GDPR for non-automated processing. Under Art. 2(1), the Regulation applies to the processing of personal data wholly or partly by automated means, and to the processing other than by automated means of personal data which form part of a filing system or are intended to form part of one. Paper medical records organised by patient, paper informed consent forms filed by subject number, investigator site files and archived case report forms are therefore within scope, even though no computer is involved. The Court of Justice (Jehovan todistajat, C-25/17) confirmed that the structure need not be sophisticated: handwritten notes organised so that a specific person's data can be retrieved suffice.
In clinical research the practical consequences are that paper archives must be protected by security measures proportionate to the risk (locked rooms, access logs, secure destruction), included in the record of processing activities, covered by retention schedules, and searchable enough to honour a right of access request. Unstructured notes that are not organised for retrieval fall outside the definition, but few research records genuinely meet that description.
