What is data processing?
Definition
Data processing means doing anything with personal data, such as collecting, recording, organising, structuring or storing it. Under the GDPR, almost every use of information about a person counts as processing.
- Category
- Data
- Also called
- processing of personal data, processing data
- Last updated
In everyday speech, data processing sounds like crunching numbers. In data protection law it is much wider. Under Article 4(2) of the GDPR, processing covers operations performed on personal data, and the ICO gives collecting, recording, organising, structuring and storing it as examples of what counts. A company that only holds your name in a database is processing it. So is one that emails you, sells your details to another firm or deletes them.
A simple example
You sign up for a store loyalty card. The store collects your name and address (processing), stores them (processing), uses them to send offers (processing) and shares your purchase history with a marketing partner (processing). Each step has to meet the rules.
What the rules require
Article 5 of the UK GDPR sets out seven principles for processing personal data: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability. In short, an organisation must have a lawful reason, tell you what it does, collect only what it needs, keep the data accurate and secure, and not keep it longer than necessary.
Who does the processing
The controller decides why and how your data is used. A processor handles data on the controller's behalf, such as a payroll or email service. Both have duties under the law, and you can use your rights against the controller.
Processing vs. related terms
- Data collection is only the first step of processing.
- Data mining is one kind of processing, analysing large datasets for patterns.
- Data scraping is automated collection, which is processing too, even when the data is public.
Why it matters to you
Because the law treats nearly every handling of your data as processing, nearly every handling needs a reason. That is the basis for your rights to see what an organisation holds, correct it, object or ask for deletion.
How to protect yourself
- 1
Read what a company says it does with your data
The privacy notice should list what it collects, why, and who it shares it with. If the list is vague, ask.
- 2
Use your access right
Ask the organisation for a copy of the personal data it holds on you. See our entry on the data subject access request.
- 3
Object or ask for deletion
Where the law gives you the right, tell the organisation in writing to stop processing or to erase your data, and keep a dated copy.
- 4
Share less to begin with
Give only the details a form really needs and use a separate email address for sign-ups you don't trust. Serus finds where your address and phone number are listed and removes them for you.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is storing data processing?
Yes. The ICO lists storing, along with collecting, recording, organising and structuring, as processing of personal data.
What are the principles of data processing?
Article 5 of the UK GDPR lists seven: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.
What is the difference between a controller and a processor?
A controller decides why and how personal data is processed. A processor handles it on the controller's behalf.
Does data processing only mean computer processing?
No. The GDPR covers processing whether it is automated or not, so paper records can count too.
Sources
Something wrong or out of date? Tell us and we'll re-check it.