Processing

Legal Framework

The GDPR defines "processing" in deliberately expansive terms. Article 4(2) sets the boundary:

"'processing' means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means"
— GDPR Art. 4(2)

This definition captures virtually every interaction with personal data — from collection and storage to alteration, disclosure, combination, and ultimately erasure or destruction. The breadth is intentional: the Regulation's substantive obligations attach to "processing" as a unitary concept, so that controllers cannot escape obligations by characterising a particular operation as something other than processing.

The material scope in Article 2 confirms that the GDPR applies to processing wholly or partly by automated means, and to non-automated processing of data forming part of a filing system. Narrow carve-outs exist for purely personal or household activities, activities outside Union law, and competent-authority criminal investigations.

Once processing falls within scope, Article 5 imposes the core principles — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity/confidentiality. The controller bears the burden of demonstrating compliance. Article 30 requires both controllers and processors to maintain records of processing activities, documenting purposes, data categories, recipients, retention periods, and security measures. Special categories of data trigger heightened conditions under Article 10 for criminal-convictions data.

Key Developments

The CJEU has consistently treated the concept of processing broadly. In Worten, the Court confirmed that all processing must satisfy both the data-quality principles and one of the legality conditions, leaving no gap for unregulated operations. The Court's reasoning under Directive 95/46 maps directly onto the GDPR's architecture.

"all processing of personal data must, subject to the exceptions permitted under Article 13, comply, first, with the principles relating to data quality set out in Article 6 of Directive 95/46 and, secondly, with one of the six principles for making data processing legitimate"
— Worten v ACT, ¶33

Enforcement authorities have applied these requirements aggressively. The CNIL imposed a €1,000,000 fine on a processor for three failures: unlawful retention, purpose conflict with contractual agreements, and absence of a processing register. The Italian Garante prohibited processing and ordered erasure where a sole proprietorship processed personal data for commercial purposes without the consent required by Article 5(1)(a). Irish and French authorities have scrutinised whether internal SOPs satisfy the Article 30 record-keeping obligation, with the DPC noting that documents not titled "ROPA" may still qualify if they substantively document access and further processing.

Status of the Debate

The definition of processing itself is settled — its statutory breadth is uncontested. What remains actively litigated is the qualification of parties and the scope of particular operations within that definition. The divergence between Schrems v Meta and earlier rulings illustrates this tension. In Schrems, the CJEU addressed whether disclosure of sexual orientation in a public panel discussion, coupled with criticism of Facebook's data practices, brought the data subject's own statements within the scope of processing analysis:

"Mr Schrems referred to his sexual orientation for the purpose of criticising Facebook's processing of personal data, including the processing of his own data"
— Schrems v Meta Platforms Ireland Limited

This case demonstrates that courts are still drawing the boundaries of what constitutes processing in context — particularly where public statements, controller-subject interactions, and secondary use of data intersect. The doctrinal terrain is contested precisely because the statutory definition is so broad that its outer limits are shaped case by case.

Practical Guidance

• Map every operation against the Article 4(2) catalogue. If your activity involves collection, storage, consultation, disclosure, combination, or erasure of personal data, it is processing — and all GDPR obligations attach.
• Maintain a compliant Article 30 record. Enforcement decisions confirm that regulators treat absent or inadequate ROPAs as standalone violations warranting substantial fines, independent of other infringements.
• Anchor each processing purpose to a specific legal basis. The Garante's prohibition order in Gagliardi shows that processing without a valid Article 6 basis leads not just to fines but to mandatory erasure orders.
• Document the controller/processor allocation explicitly. As the Rechtbank Midden-Nederland ruling illustrates, qualifying parties correctly under the GDPR is the threshold question that determines the entire obligation framework.
• Review retention limits against stated purposes. The CNIL's €1,000,000 fine arose partly from retaining data beyond the period consistent with contractual purposes — a direct violation of the Article 5(1)(e) storage-limitation principle.