Recordkeeping and archiving

Purpose: Safe handling of projects as official records under the principle of public access to information.

A. When should a project be registered in the registry?

• MUST: The decision to start the project is registered.
• MUST: The decision to publish the project externally for the first time is registered.
• MUST: The decision to close down or archive the project is registered.
• MUST: The link between the registry entry and the repository (URL/ID) is documented, so that the project in the registry can be traced to its code and vice versa.

B. Which records are registered?

• MUST: Decision documents (start memo, licence choice, risk and security assessments) are registered.
• MUST: The decision to publish source code is registered.
• MUST: Any agreements on joint development are registered.
• MUST: Documentation on archiving or closing down is registered.

C. Archiving the project

• MUST: The project’s status is updated (e.g. archived on the code-collaboration platform, noted in the README).
• MUST: An assessment of what is to be retained for the long term has been made.
• MUST: Any records to be preserved outside the platform have been exported in accordance with the archival function’s instructions.
• MUST: The archival function has been consulted where required.

D. Disposal and GDPR

• MUST: Disposal of records follows applicable regulations and the applicable archival schedule.
• MUST: The disposal decision is documented.
• MUST: A GDPR assessment has been carried out if personal data has appeared in issues, pull requests or commit messages. Personal data may remain in history even after it has been removed from the current version.