IAPP Training · Module 4 - BoK III.A
Module 4 · The data processing life cycle
Last reviewed:
Processing is defined sweepingly in Article 4(2): any operation performed on personal data, automated or not - from collection and storage right through to erasure and destruction. Almost anything you do with data counts.
Article 4(2) defines processing as any operation, or set of operations, performed on personal data, whether or not by automated means. The list is illustrative, not exhaustive.
- Collection, recording, organisation, structuring
- Storage, adaptation or alteration
- Retrieval, consultation, use
- Disclosure by transmission, dissemination or otherwise making available
- Alignment or combination
- Restriction, erasure or destruction
The breadth point
Because processing covers any action performed on data, you almost never escape the GDPR by arguing "we didn't really process it." If you touched the data, you processed it.
Key terms - quick answers
What is “Processing”?
Any operation or set of operations performed on personal data, whether or not by automated means (Article 4(2)).
Keep going - free
Every study note on this site is free. So are these: