processing

The term processing covers almost anything that can be done to digital personal data. Under the law, it means any operation or set of operations performed on this data, as long as the action is wholly or partly automated. This means that if a process involves digital automation at any step, it falls under this definition. The law provides a long list of examples to show how broad this term is. Processing includes the very first steps of handling data, such as collection, recording, organisation, and storage. It also covers how data is used and managed day-to-day, including structuring, adaptation, retrieval, use, alignment, combination, and indexing. Finally, the definition covers how data is shared or disposed of. Sharing, disclosure by transmission, dissemination, or otherwise making the data available all count as processing. Even the acts of restricting, erasing, or destroying digital personal data are explicitly defined as processing. Because the text says processing includes operations such as these, the list is not exhaustive, meaning other similar automated actions are also covered.

Key points

• Processing means any operation or set of operations performed on digital personal data. (Section 2(x))
• The operation must be wholly or partly automated to qualify as processing. (Section 2(x))
• The definition includes early-stage actions like collection, recording, and storage. (Section 2(x))
• It also covers later-stage actions like sharing, disclosure, erasure, and destruction. (Section 2(x))
• The list of actions is not exhaustive, as it states processing includes operations such as the ones listed. (Section 2(x))

Common misreadings

• A reader might think processing only means analyzing or changing data, but the definition explicitly includes simply collecting, storing, or erasing it.
• A reader might assume entirely manual paper records are included, but the text specifies the operation must be wholly or partly automated and performed on digital personal data.