With the Luxembourg Electronic Archiving bill (6543) many businesses wonder if they shoud become PSDC or not. Labgroup, the ILM expert in Luxembourg, offers some answers to your questions: > What guarantees the PSDC status ? > Does my company need to become PSDC ? > How to become PSDC ? > How much it cost to become PSDC ? Please contact us if you have any other questions and visit our website www.labgroup.com for more informations.

1. Electronic Archiving 2.0
Luxembourg draft Law n°6543
Become a PSDC or not?

2. © Labgroup 2013
Introduction
>Authors:
Jean RACINE - Business Development
Director at Labgroup, co-founder and
Secretary-General of FedISA Luxembourg
(Fédération de l’ILM, du Stockage et de
l’Archivage - asbl )
CatherineDI LORENZO - Avocat à la
Cour, Allen & Overy Luxembourg, specialised
in information technology, intellectual
property and regulatory issues

3. >Supersedes obsolete regulation of 22/12/1986
>Amends the law of 5 April 1993 on the financial sector
>Removes e-archiving from the scope of article 1333
of the Civil Code
>Defines the requirements (technology-neutral) for:
>Thedigitisationof originaldocumentsas digitalcopies
>Thearchivingof digital copies and digital-formoriginals
>Specifies the requirements under which copies may
benefit from a presumption of conformity with the original
>Sets out the rules applicable to the activity of providers of
digitisation and/or archiving services (PSDC)
© Labgroup 2013
What about draft law N° 6543?

4. >Compliance with legal framework, i.e. probative value
of archives, under the supervision of the State
>Sound administrative organisation and management
>Adequate human, financial and material resources to
operate satisfactorily
>Risk based approach through an Information Security
Management System (ISMS)
>Application of appropriate technical & organisational
methods and procedures (cf.theDataProtectionAct?)
>Observance of professional secrecy
© Labgroup 2013
What guarantees the PSDC status? (1/3)

5. >Information prior to any contractual agreement, on a
durable medium, in clear and comprehensible terms,
about at least:
>The procedure for digitisation and/or archiving
>The procedure to restore and return copies in a readable form
whilst certifying the conformity to the originals
>Existence and conditions of subcontracting
>Legal obligations imposed on PSDCs
>Service delivery contractual conditions, including liability
limitations or exclusions
>Standardsand procedures implemented
>Equipment'smain technical characteristics
© Labgroup 2013
What guarantees the PSDC status? (2/3)

6. >Information duty towards ILNAS when an event or
circumstance is likely to lead to certification loss
>Information duty towards customers:
>Without delay in case of status suspension or withdrawal
>1 month in advance in the event of termination
>Right to the return or the transfer of archives in case
of certification loss or termination, and in case of
bankruptcy (without being subject to the PSDC’s
creditors’, bankruptcy receiver’s or liquidator’s claims )
>Exemption from seizure of hardware and media
(there is a ban to create liens or use as collaterals the equipment
and media on which customers’ digital copies or digital-form
originals are stored)
© Labgroup 2013
What guarantees the PSDC status? (3/3)

7. >Businesses may consider 3 options:
>Becoming a PSDC
If reaching a critical mass renders this profitable, their archives
(as well as those of other entities of their group) will benefit
from the legal presumption
>Not becoming a PSDC
In this case, they will have to demonstrate in every case of
dispute that they have created and preserved digital copies
respecting certain technical and organisational conditions that
allow to guarantee that archives are faithful and lasting copies
>Outsourcing to a PSDC
Possible only for digitisation, or only for archiving of their
records which have a crucial probative value
© Labgroup 2013
Does my company need to become PSDC?

8. © Labgroup 2013
How to become PSDC?
PREPARATION
CERTIFICATION
NOTIFICATION
VALIDATION
SUPERVISION
PUBLICATION
For strict conformity to "Technical regulation requirements
and measures for certifying Digitisation or Archiving Service
Providers (PSDC)" version 1.3, edited by ILNAS
Following audit by a Conformity Assessment Body (CAB)
duly accredited by OLAS or by mutual recognition
With transmission of the final audit report, and any other
piece of information or evidence (certifications)
Based on the timeliness of the CAB's accreditation and
of the information transmitted, and the effective resolution
of the deviations revealed by the audit
By means of biannual meetings, annual
reporting, compulsory notification of any change by the
PSDC,
and additional checks by ILNASIn the official gazette (Mémorial) or the press, and on
ILNAS’ website

9. >The technical regulation is based on international
standards, such as ISO/IEC 27001 & ISO/IEC 27002
on information security management, ISO/IEC 15489
on record management, and ISO 30301 on
information & documentation management
>ILNASconfirmed thatpreparation andcertificationwould
beeasedforthosepreviously ISO/IEC27001certified
>Estimate would be:
ISO/IEC 27001 certification cost
+ cost of certification related to specific requirements
of digitisation and/or archiving
© Labgroup 2013
How much it costs to become PSDC? (1/3)

10. >A PSDC which would like to provide services to the
financial sector must obtain the agreement of the
CSSF in order to operate as a 'Support PSF':
>29-5for digitisation
>29-6for archiving
>So far ILNAS has not given any information on the
cost of their services (annual fee?)
>Risk management, management of information
security and of internal audit should be strongly
reinforced within the organisation
© Labgroup 2013
How much it costs to become PSDC? (2/3)

11. >Preparation time is counted in (many) months
>According to ILNAS, the process from certification to
publication will cost… some months of time
>To date, only one potential Conformity Assessment
Body (CAB) is known, namely Société Nationale de
Certification et d'Homologation, owned by the State
© Labgroup 2013
How much it costs to become PSDC? (3/3)

12. >Ask it now… to jracine@labgroup.com
© Labgroup 2013
Questions?