IAPP Training · Module 4 - BoK III.A

Module 4 · The data processing life cycle

Processing is defined sweepingly in Article 4(2): any operation performed on personal data, automated or not - from collection and storage right through to erasure and destruction. Almost anything you do with data counts.

Article 4(2) defines processing as any operation, or set of operations, performed on personal data, whether or not by automated means. The list is illustrative, not exhaustive.

Collection, recording, organisation, structuring
Storage, adaptation or alteration
Retrieval, consultation, use
Disclosure by transmission, dissemination or otherwise making available
Alignment or combination
Restriction, erasure or destruction

The breadth point

Because processing covers any action performed on data, you almost never escape the GDPR by arguing "we didn't really process it." If you touched the data, you processed it.

Key terms - quick answers

What is “Processing”?

Any operation or set of operations performed on personal data, whether or not by automated means (Article 4(2)).

← Module 3 · Vendor management and the Article 28 contract Module 4 · Data processing principles (OECD + Article 5) →