# Processing — legal context bundle > Curated from overview.legal on 2026-10-13. Canonical page: https://overview.legal/topics/processing > Sources are cited per item. Verify against the official texts before relying on them. Any operation performed on personal data ## Overview ## Legal Framework The GDPR defines "processing" in deliberately expansive terms. Article 4(2) sets the boundary: > "'processing' means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means" > — [GDPR Art. 4(2)](/laws/gdpr/art-4#par-2) This definition captures virtually every interaction with personal data — from collection and storage to alteration, disclosure, combination, and ultimately erasure or destruction. The breadth is intentional: the Regulation's substantive obligations attach to "processing" as a unitary concept, so that controllers cannot escape obligations by characterising a particular operation as something other than processing. The material scope in [Article 2](/laws/gdpr/art-2) confirms that the GDPR applies to processing wholly or partly by automated means, and to non-automated processing of data forming part of a filing system. Narrow carve-outs exist for purely personal or household activities, activities outside Union law, and competent-authority criminal investigations. Once processing falls within scope, [Article 5](/laws/gdpr/art-5) imposes the core principles — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity/confidentiality. The controller bears the burden of demonstrating compliance. [Article 30](/laws/gdpr/art-30) requires both controllers and processors to maintain records of processing activities, documenting purposes, data categories, recipients, retention periods, and security measures. Special categories of data trigger heightened conditions under [Article 10](/laws/gdpr/art-10) for criminal-convictions data. ## Key Developments The CJEU has consistently treated the concept of processing broadly. In *Worten*, the Court confirmed that all processing must satisfy both the data-quality principles and one of the legality conditions, leaving no gap for unregulated operations. The Court's reasoning under Directive 95/46 maps directly onto the GDPR's architecture. > "all processing of personal data must, subject to the exceptions permitted under Article 13, comply, first, with the principles relating to data quality set out in Article 6 of Directive 95/46 and, secondly, with one of the six principles for making data processing legitimate" > — [Worten v ACT, ¶33](/posts/132375#seg-33) Enforcement authorities have applied these requirements aggressively. The CNIL imposed a €1,000,000 fine on a processor for three failures: unlawful retention, purpose conflict with contractual agreements, and absence of a processing register. The Italian Garante prohibited processing and ordered erasure where a sole proprietorship processed personal data for commercial purposes without the consent required by [Article 5(1)(a)](/laws/gdpr/art-5). Irish and French authorities have scrutinised whether internal SOPs satisfy the [Article 30](/laws/gdpr/art-30) record-keeping obligation, with the DPC noting that documents not titled "ROPA" may still qualify if they substantively document access and further processing. ## Status of the Debate The definition of processing itself is settled — its statutory breadth is uncontested. What remains actively litigated is the *qualification* of parties and the *scope* of particular operations within that definition. The divergence between *Schrems v Meta* and earlier rulings illustrates this tension. In *Schrems*, the CJEU addressed whether disclosure of sexual orientation in a public panel discussion, coupled with criticism of Facebook's data practices, brought the data subject's own statements within the scope of processing analysis: > "Mr Schrems referred to his sexual orientation for the purpose of criticising Facebook's processing of personal data, including the processing of his own data" > — [Schrems v Meta Platforms Ireland Limited](/posts/132159) This case demonstrates that courts are still drawing the boundaries of what constitutes processing in context — particularly where public statements, controller-subject interactions, and secondary use of data intersect. The doctrinal terrain is contested precisely because the statutory definition is so broad that its outer limits are shaped case by case. ## Practical Guidance - **Map every operation against the Article 4(2) catalogue.** If your activity involves collection, storage, consultation, disclosure, combination, or erasure of personal data, it is processing — and all GDPR obligations attach. - **Maintain a compliant Article 30 record.** Enforcement decisions confirm that regulators treat absent or inadequate ROPAs as standalone violations warranting substantial fines, independent of other infringements. - **Anchor each processing purpose to a specific legal basis.** The Garante's prohibition order in *Gagliardi* shows that processing without a valid Article 6 basis leads not just to fines but to mandatory erasure orders. - **Document the controller/processor allocation explicitly.** As the *Rechtbank Midden-Nederland* ruling illustrates, qualifying parties correctly under the GDPR is the threshold question that determines the entire obligation framework. - **Review retention limits against stated purposes.** The CNIL's €1,000,000 fine arose partly from retaining data beyond the period consistent with contractual purposes — a direct violation of the Article 5(1)(e) storage-limitation principle. ## Legislation (full text of key provisions) ### Principles relating to processing of personal data *Source: GDPR, gdpr-art-5-en, 2016-04-27 — https://overview.legal/posts/90243* ### Records of processing activities *Source: GDPR, gdpr-art-30-en, 2016-04-27 — https://overview.legal/posts/90594* ### Processing of personal data relating to criminal convictions and offences *Source: GDPR, gdpr-art-10-en, 2016-04-27 — https://overview.legal/posts/90322* Processing of personal data relating to criminal convictions and offences or related security measures based on Article 6(1) shall be carried out only under the control of official authority or when the processing is authorised by Union or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any comprehensive register of criminal convictions shall be kept only under the control of official authority. ### Further processing of personal data for developing certain AI systems in the public interest in the AI regulatory sandbox *Source: AI Act, aiact-art-59-en, 2024-06-12 — https://overview.legal/posts/92939* ### Article 39 *Source: EU, eu-art-39-38432, 2012-10-26 — https://overview.legal/posts/38433* In accordance with Article 16 of the Treaty on the Functioning of the European Union and by way of derogation from paragraph 2 thereof, the Council shall adopt a decision laying down the rules relating to the protection of individuals with regard to the processing of personal data by the Member States when carrying out activities which fall within the scope of this Chapter, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities. ### Services concerned *Source: ePrivacy Directive, eprivacy-art-3-en, 2002-07-12 — https://overview.legal/posts/132170* Services concernedThis Directive shall apply to the processing of personal data in connection with the provision of publicly available electronic communications services in public communications networks in the Community, including public communications networks supporting data collection and identification devices. ### Recital 82 — records of processing activities *Source: GDPR, gdpr-rec-82-en, 2016-04-27 — https://overview.legal/posts/91679* In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations. ### Recital 50 — compatible further processing of personal data *Source: GDPR, gdpr-rec-50-en, 2016-04-27 — https://overview.legal/posts/91615* The processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purposes for which the personal data were initially collected. In such a case, no legal basis separate from that which allowed the collection of the personal data is required. If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful. Further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected, the controller, after having met all the requirements for the lawfulness of the original processing, should take into account, inter alia: any link between those purposes and the purposes of the intended further processing; the context in which the personal data have been collected, in particular the reasonable expectations of data subjects based on their relationship with the controller as to their further use; the nature of the personal data; the consequences of the intended further processing for data subjects; and the existence of appropriate safeguards in both the original and intended further processing operations. Where the data subject has given consent or the processing is based on Union or Member State law which constitutes a necessary and proportionate measure in a democratic society to safeguard, in particular, important objectives of general public interest, the controller should be allowed to further process the personal data irrespective of the compatibility of the purposes. In any case, the application of the principles set out in this Regulation and in particular the information of the data subject on those other purposes and on his or her rights including the right to object, should be ensured. Indicating possible criminal acts or threats to public security by the controller and transmitting the relevant personal data in individual cases or in several cases relating to the same criminal act or threats to public security to a competent authority should be regarded as being in the legitimate interest pursued by the controller. However, such transmission in the legitimate interest of the controller or further processing of personal data should be prohibited if the processing is not compatible with a legal, professional or other binding obligation of secrecy. ### Recital 162 — statistical processing of personal data *Source: GDPR, gdpr-rec-162-en, 2016-04-27 — https://overview.legal/posts/91839* Where personal data are processed for statistical purposes, this Regulation should apply to that processing. Union or Member State law should, within the limits of this Regulation, determine statistical content, control of access, specifications for the processing of personal data for statistical purposes and appropriate measures to safeguard the rights and freedoms of the data subject and for ensuring statistical confidentiality. Statistical purposes mean any operation of collection and the processing of personal data necessary for statistical surveys or for the production of statistical results. Those statistical results may further be used for different purposes, including a scientific research purpose. The statistical purpose implies that the result of processing for statistical purposes is not personal data, but aggregate data, and that this result or the personal data are not used in support of measures or decisions regarding any particular natural person. ### Recital 74 — controller responsibility liability and compliance measures *Source: GDPR, gdpr-rec-74-en, 2016-04-27 — https://overview.legal/posts/91663* The responsibility and liability of the controller for any processing of personal data carried out by the controller or on the controller's behalf should be established. In particular, the controller should be obliged to implement appropriate and effective measures and be able to demonstrate the compliance of processing activities with this Regulation, including the effectiveness of the measures. Those measures should take into account the nature, scope, context and purposes of the processing and the risk to the rights and freedoms of natural persons. ## Case law ### Judgment of the Court (Third Chamber), 22 November 2012.#Josef Probst v mr.nexnet GmbH.#Reference for a preliminary ruling from the Bundesgerichtshof.#Electronic communications — Directive 2002/58/EC — Article 6(2) and (5) — Processing of personal data — Traffic data necessary for billing and debt collection — Debt collection by a third company — Persons acting under the authority of the providers of public communications networks and electronic communications services.#Case C‑119/12. *Source: Court of Justice of the European Union, C-119/12, 2012-11-22 — https://overview.legal/posts/132376 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0119* In Case C-119/12, the Court of Justice of the European Union interpreted Article 6(2) and (5) of Directive 2002/58/EC (the ePrivacy Directive) in proceedings between Josef Probst and mr.nexnet GmbH, arising from a reference for a preliminary ruling by the German Federal Court of Justice (Bundesgerichtshof). The core issue was whether a telecommunications provider may transfer traffic data to a third-party debt collection company that has acquired the debt through assignment, and whether such a third party qualifies as a person "acting under the authority" of the provider under Article 6(5). The Court held that traffic data necessary for billing may be processed for debt collection purposes, including by an assignee third party, provided that the third party acts under the authority of the provider and the processing is limited to what is necessary for that purpose, with the data subject to the safeguards of Directive 95/46/EC. No fine was imposed. ### Judgment of the Court (Third Chamber), 30 May 2013.#Worten — Equipamentos para o Lar SA v Autoridade para as Condições de Trabalho (ACT).#Request for a preliminary ruling from the Tribunal do Trabalho de Viseu.#Processing of personal data — Directive 95/46/EC — Article 2 — Concept of ‘personal data’ — Articles 6 and 7 — Principles relating to data quality and criteria for making data processing legitimate — Article 17 — Security of processing — Working time — Record of working time — Access by t *Source: Court of Justice of the European Union, C-342/12, 2013-05-30 — https://overview.legal/posts/132375 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0342* The Court of Justice of the European Union (Third Chamber) ruled on a preliminary reference from a Portuguese labor court in proceedings between Worten—Equipamentos para o Lar SA and the Autoridade para as Condições de Trabalho (ACT) concerning whether employer working time records constitute personal data under Directive 95/46/EC and must be made available to labor authorities. The Court held that working time records containing information identifying individual workers constitute personal data within the meaning of Article 2 of Directive 95/46/EC, and that employers must maintain such records in a form allowing immediate consultation by competent national authorities responsible for monitoring working conditions, as this processing is necessary for compliance with legal obligations and the performance of tasks carried out in the public interest under Articles 7(c) and 7(e). ### CJEU: Search engine operator is a data controller under Directive 95/46 *Source: CJEU, 2014-05-13 — https://overview.legal/posts/6160 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0131&ref=6160* Concept of ‘controller’: A search engine operator determines the purposes and means of that activity and thus of the processing of personal data that it itself carries out within the framework of the activity and is thus a controller. (¶¶ 33–41) ### Judgment of the Court (Third Chamber), 7 November 2013.#Institut professionnel des agents immobiliers (IPI) v Geoffrey Englebert and Others.#Request for a preliminary ruling from the Cour constitutionnelle (Belgium).#Processing of personal data — Directive 95/46/EC — Articles 10 and 11 — Obligation to inform — Article 13(1)(d) and (g) — Exceptions — Scope of exceptions — Private detectives acting for the supervisory body of a regulated profession — Directive 2002/58/EC — Article 15(1).#Case C‑47 *Source: Court of Justice of the European Union, C-473/12, 2013-11-07 — https://overview.legal/posts/132373 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0473* The Court of Justice of the European Union (Third Chamber) issued a preliminary ruling in response to a request from the Belgian Cour constitutionnelle in proceedings between the Institut professionnel des agents immobiliers (IPI) and Geoffrey Englebert, Immo 9 SPRL, and Grégory Francotte. The case concerned the interpretation of Article 13(1)(d) and (g) of Directive 95/46/EC, specifically whether the obligation to inform data subjects under Articles 10 and 11 may be restricted when private detectives process personal data on behalf of a regulated profession's supervisory body to investigate breaches of professional ethics. The Court held that the exceptions in Article 13(1)(d) and (g) must be interpreted strictly and that data processing by private detectives acting for such a supervisory body falls within the scope of these exceptions only to the extent that it constitutes a necessary measure to safeguard the prevention, investigation, detection, and prosecution of breaches of ethics for regulated professions. ### Judgment of the Court (Grand Chamber), 8 April 2014.#European Commission v Hungary.#Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another per *Source: Court of Justice of the European Union, C-288/12, 2014-04-08 — https://overview.legal/posts/132371 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0288* The European Commission brought an infringement action against Hungary before the Court of Justice (Grand Chamber) under Article 258 TFEU, alleging that Hungary violated Article 28(1) of Directive 95/46/EC by adopting national legislation that prematurely terminated the term of its existing data protection supervisory authority and appointed a new head. The Court ruled that Hungary had failed to fulfil its obligations, holding that the independence of supervisory authorities under Article 28(1) requires that their term of office cannot be brought to an end without legitimate justification, and that a Member State may not reduce the originally established term of office through general legislation without respecting the conditions previously governing the termination of that term. No fine was imposed in this judgment. ### CJEU Bara: Transfer of tax data by ANAF to CNAS constitutes processing of personal data *Source: CJEU, 2015-10-01 — https://overview.legal/posts/6150 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62014CJ0201&ref=6150* Processing: Both the transfer of the data by ANAF, and the subsequent processing by CNAS, constitute processing of personal data. (¶ 29) ### CJEU: Communicating IP subscriber's name and address is processing of personal data *Source: CJEU, 2012-04-19 — https://overview.legal/posts/6173 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62010CJ0461&ref=6173* Processing: Communication of name and address sought by applicants constitutes processing of personal data. (¶ 52) ### Judgment of the Court (Eighth Chamber), 12 December 2013.#X.#Request for a preliminary ruling from the Gerechtshof te ’s-Hertogenbosch.#Protection of individuals with regard to the processing of personal data — Directive 95/46/EC — Conditions for exercising a right of access — Levying of excessive fees.#Case C‑486/12. *Source: Court of Justice of the European Union, C-486/12, 2013-12-12 — https://overview.legal/posts/132372 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62012CJ0486* In Case C-486/12, the Court of Justice of the European Union interpreted Article 12(a) of Directive 95/46/EC in response to a preliminary ruling from the Gerechtshof te 's-Hertogenbosch concerning whether a Dutch municipality could levy a fee for providing a data subject with a certified transcript of personal data. The core issue was whether the directive's guarantee of access "without excessive delay or expense" permits controllers to charge fees, or whether the term "expense" should be read disjunctively from "delay," potentially allowing reasonable fees. The Court held that while Article 12(a) does not categorically prohibit fees for access to personal data, any fee charged must not be excessive, meaning it must not pose a deterrent to the exercise of the right of access, and that a fee is likely excessive if it exceeds the cost of reproducing and communicating the data. ### UZ v Bundesrepublik Deutschland *Source: Court of Justice of the European Union, C-60/22, 2023-05-04 — https://overview.legal/posts/132289 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0060* In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik Deutschland regarding the processing of personal data in an asylum application file. The Court held that an administrative authority transmitting an electronic asylum file to a competent national court via an electronic mailbox constitutes processing under the GDPR, and that where both the authority and the court determine the purposes and means of processing, they are joint controllers under Article 26, requiring an arrangement allocating responsibility and maintaining records of processing activities under Article 30. The Court further clarified that transmission of personal data without the data subject's consent constitutes unlawful processing, triggering the right to erasure under Article 17(1)(d) and the right to restriction under Article 18(1)(b), and that national courts must disregard such unlawfully processed data. No fine was imposed. ### État belge v Autorité de protection des données *Source: Court of Justice of the European Union, C-231/22, 2024-01-11 — https://overview.legal/posts/132274 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0231* In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court of Appeal in proceedings between the Belgian State and the Belgian Data Protection Authority concerning whether the managing authority of the Moniteur belge (Belgium's official journal) constitutes a "controller" under the GDPR. The central issue was whether a Member State authority that is legally obligated to publish company documents containing personal data, as prepared and submitted by third parties, determines the purposes and means of processing within the meaning of Article 4(7). The Court held that such an authority does qualify as a controller because, by disseminating the personal data to the public, it determines the means of making the data accessible and exercises autonomous control over that processing operation, even though it does not determine the content of the published documents; no fine was at issue in this preliminary ruling. ### US Zagreb - Us I-4772/2023-10 *Source: Administrative Court of Zagreb, 2026-07-22 — https://overview.legal/posts/291262 — original: https://gdprhub.eu/index.php?title=US_Zagreb_-_Us_I-4772/2023-10* Facts — A utility and municipal services enterprise, Zagrebački Holding d.o.o. (the controller) provided users of its services with the option to request a copy of their bill via email. Where the name appearing in the email address differed from the user’s name, the controller requested a copy of an identification document as part of the process of verifying the identity of its users. It treated that discrepancy as an indication of possible identity fraud. According to the controller, users were asked to redact any information on the document that was not necessary for identification. In addition, the copies were deleted once the relevant purpose had been fulfilled and access to them was limited to a small number of authorised employees. The Croatian DPA (AZOP) found that the controller had not adequately informed users of the legal basis for collecting copies of identification documents, the applicable retention period, or whether providing such a copy was mandatory and what the consequences of not providing it would be. It held that the controller had infringed Article 13(1)(c) GDPR, Article 13(2)(a) GDPR and Article 13(2)(e) GDPR. Furthermore, it found that the company had not implemented appropriate technical and organizational measures for the process of verifying the identity of users who requested copies of bills via email, in violation of Article 25(2) GDPR. It fined the controller €25,000. The controller challenged the decision before the Administrative Court of Zagreb. It argued that it had published information on its website regarding the processing of personal data. It claimed that the information had been modelled on guidelines published by the EDPB. The controller further alleged that users had been informed that the data would not be retained for longer than was necessary for the purpose of the processing. It also argued that it did not collect an excessive amount of data, as it asked users to redact unnecessary information and that copies were deleted after verification was completed. The DPA pointed out that the information regarding data retention was contradictory or open to different interpretations, and that the controller’s deficiencies were not corrected even when a user requested clarification directly from the controller. Regarding the identification process, the DPA argued that the controller could have achieved the same objective without requesting copies of identification documents, for example by using previously verified email addresses. It considered that a discrepancy between a user’s name and the name associated with an email address did not constitute a reliable criterion for detecting potential identity fraud. According to the DPA, the procedure was not designed with sufficient consideration of the nature, context, and risks of the specific processing, and the mere instruction to users to redact parts of their identification document did not constitute a sufficient safeguard. Holding — The court held that the controller had not transparently provided users with the legal basis for collecting copies of identification documents. It found that this information was neither available in the controller’s published documents nor provided when users requested it directly via email. The court therefore upheld the finding of an infringement of Article 13(1)(c) GDPR. The court further found that the information concerning the retention period could be interpreted in different ways. In response to a specific inquiry, the controller should have provided clear information on the duration of the storage. It ruled that this amounted to an infringement of Article 13(2)(a) GDPR. The court also noted that one user had been told that the requested data could not be provided without an identification document, while the controller later stated before the DPA that users unwilling to send a copy could instead present it in person at the Holding Centre in Zagreb. In light of the lack of clear information as to whether providing the identification document was mandatory and the consequences of not providing it, the court upheld the finding of an infringement of Article 13(2)(e) GDPR. Moreover, the court agreed with the DPA that the controller had not implemented appropriate technical and organisational measures for the identification procedure. It determined that the format or name of an email address did not provide sufficient assurance that a request actually originated from the user concerned, while the procedure effectively required certain users to provide a copy of an identification document in order to communicate remotely. The court pointed out that processing such copies could pose a high risk to individuals’ rights, such as identity theft. The court considered that the controller could instead have established a secure email-verification procedure, allowing users to verify an email address for communications and the delivery of bills, while ensuring that the identification procedure applied consistently regardless of the structure of the email address. It therefore upheld the finding that the controller had failed to implement appropriate safeguards in breach of Article 25(2) GDPR. Furthermore, the court rejected the controller’s reliance on the EDPB’s practice, noting that it concerned a different context, namely the verification of the identity of individuals exercising their rights under the GDPR. It acknowledged that an ID copy may be justified in higher-risk situations, such as certain GDPR rights requests involving sensitive or extensive data, or where the controller has no ongoing relationship with the requester. However, it held that this did not affect the infringements established in relation to the controller’s procedure for issuing copies of bills. The court upheld the DPA’s €25,000 fine. ### Amt der Tiroler Landesregierung v Datenschutzbehörde *Source: Court of Justice of the European Union, C-638/23, 2025-02-27 — https://overview.legal/posts/132147 — original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023CJ0638* In Case C-638/23, the Court of Justice interpreted Article 4(7) GDPR in response to a preliminary reference from the Austrian Verwaltungsgerichtshof in proceedings between the Amt der Tiroler Landesregierung (Office of the Provincial Government of Tyrol) and the Datenschutzbehörde (Austrian Data Protection Authority). The core issue was whether an auxiliary administrative entity lacking legal personality and legal capacity, operating in the service of a regional government, qualifies as a "controller" under the GDPR when national law directly designates it to determine the purposes and means of personal data processing. The Court held that such an entity may be designated as a controller by Member State law provided it in fact determines the purposes and means of the processing, with the concept of "other body" in Article 4(7) not requiring the entity to possess legal personality or its own legal capacity. ## Guidance ### Position Paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR *Source: EDPB, position-paper-on-the-derogations-from-the-obligation-to-maintain-records-en, 2018-04-19 — https://overview.legal/posts/126338 — original: https://www.edpb.europa.eu/documents/other-guidance/position-paper-on-the-derogations-from-the-obligation-to-maintain-records_en* Position Paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR Други насоки 19 April 2018 During its first plenary meeting the European Data Protection Board endorsed the GDPR related WP29 Guidelines. Position Paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR Related topics: #Accountability Related documents Съвместно становище 01/2025 на ЕКЗД и ЕНОЗД във връзка с Предложението за регламент относно мерките за опростяване на процедурите за МСП и МПСПК и по-специално задължението за водене на регистър съгласно член 30, параграф 5 от ОРЗД Законодателно становище09 July 2025#Controller/processor#ОтчетностRead more about Съвместно становище 01/2025 на ЕКЗД и… ### Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects *Source: EDPB, guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in-en, 2019-10-16 — https://overview.legal/posts/126202 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-22019-on-the-processing-of-personal-data-under-article-61b-gdpr-in_en* 1 Adopted Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects Version 2.0 8 October 2019 2 Adopted Version history Version 2.0 8 October 2019 Adoption of the Guidelines after public consultation Version 1.0 9 April 2019 Adoption of the Guidelines for publication consultation 3 Adopted 1 Part 1 – Introduction ................................ ................................… ### Statement on the processing of personal data in the context of the COVID-19 outbreak *Source: EDPB, statement-on-the-processing-of-personal-data-in-the-context-of-the-covid-19-en, 2020-03-19 — https://overview.legal/posts/126176 — original: https://www.edpb.europa.eu/documents/statement/statement-on-the-processing-of-personal-data-in-the-context-of-the-covid-19_en* 1 Statement on the processing of personal data in the context of the COVID - 19 outbreak . Adopted on 19 March 2020 The European Data Protection Board has adopted the following statement: Governments, p ublic and private organisations throughout Europe are taking measures to contain and mitigate COVID - 19. This can involve the processing of different types of personal data. Data protection rules ( such as the GDPR ) do not hinder measures taken in the fight against the coronavirus pandemic.… ### Opinion 26/2024 on the draft decision of the DE Bremen Supervisory Authority regarding the “Catalogue of Criteria for the Certification of IT-supported processing of Personal Data pursuant to art 42 GDPR (‘GDPR – information privacy standard’)” presented *Source: EDPB, opinion-262024-on-the-draft-decision-of-the-de-bremen-en, 2024-12-02 — https://overview.legal/posts/125701 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-262024-on-the-draft-decision-of-the-de-bremen_en* Adopted 1 Opinion 26 / 2024 on the draft decision of the DE Bremen Supervisory Authority regarding the “Catalogue of Criteria for the Certification of IT - supported processing of Personal Data pursuant to art 42 GDPR (‘GDPR – information privacy standard’)” presented by datenschutz c ert GmbH Adopted on 2 December 2024 Adopted 2 Adopted 3 The European Data Protection Board Having regard to Article 63, Article 64(1)(c) and Article 42 of the Regulation 2016/679/EU of the European Parliament and… ### Guidelines 02/2025 on processing of personal data through blockchain technologies *Source: EDPB, edpb-guidelines-202502-blockchain-en, 2026-07-07 — https://overview.legal/posts/50755 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-022025-on-processing-of-personal-data-through-blockchain_en* EDPB, Guidelines 02/2025 on processing of personal data through blockchain technologies, 2025. ### Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models *Source: EDPB, opinion-282024-on-certain-data-protection-aspects-related-to-en, 2024-12-18 — https://overview.legal/posts/125697 — original: https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-282024-on-certain-data-protection-aspects-related-to_en* Adopted 1 Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models Adopted on 17 December 2024 Adopted 2 Executive summary AI technologies create many opportunities and benefits across a wide range of sectors and social activities. By protecting the fundamental right to data protection, GDPR supports these opportunities and promotes other EU fundamental rights, including the right to freedom of thought, expression and information,… ### Guidelines on processing of personal data through blockchain technologies *Source: EDPB, guidelines-on-processing-of-personal-data-through-blockchain-technologies-en, 2026-07-07 — https://overview.legal/posts/125668 — original: https://www.edpb.europa.eu/documents/guideline/guidelines-on-processing-of-personal-data-through-blockchain-technologies_en* Guidelines 02/2025 on processing of personal data through blockchain technologies Version 2.0 Adopted on 07 July 2026 1 | Adopted Version history Version Date Adoption information version 1.1 08 April 2025 adoption of the guidelines before public consultation version 2.0 07 July 2026 adoption of the guidelines after public consultation 3 | Adopted 4 | Adopted The European Data Protection Board Having regard to Article 70 (1)(e) of the Regulation 2016/679/EU of the European Parliament and of the… ### Statement on the processing of personal data in the context of reopening of borders following the COVID-19 outbreak *Source: EDPB, statement-on-the-processing-of-personal-data-in-the-context-of-reopening-of-en, 2020-06-16 — https://overview.legal/posts/126144 — original: https://www.edpb.europa.eu/documents/statement/statement-on-the-processing-of-personal-data-in-the-context-of-reopening-of_en* 1 Statement on the processing of personal data in the context of reopening of borders following the COVID - 19 outbreak Adopted on 16 June 2020 The European Data Protection Board has adopted the following statement: 1. In the Communication from the Commission on the third assessment of the application of the temporary restriction on non - essential travel to the EU from 11 June 2020, the Schengen Member States and Schengen Associated State s are invited to lift internal border controls by 15… ## Enforcement decisions ### CNIL fines data processor €1,000,000 for unlawful retention, purpose conflict, and no ROPA *Source: CNIL, 2026-01-13 — https://overview.legal/posts/51881* The data protection authority (DPA) has imposed a fine of 1 million euros on a data processor for failing to delete user personal data, processing that data for purposes that conflict with contractual agreements, and failing to maintain a record of processing activities. The data protection authority (DPA) has imposed a fine of €1,000,000 on a data processor for failing to delete user personal data, processing that data for purposes that conflict with contractual agreements, and failing to maintain a record of processing activities. Finally, the DPA found that... ### NATIONALE VERENIGING VAN TAXATIE-EXPERTEN EN RECHTELIJKE EXPERTS OP HET GEBIED VAN INFORMATICA: Onvoldoende naleving van de rechten van betrokkenen bij de verwerking van persoonsgegevens. *Source: Spanish Data Protection Authority (aepd), 2025-11-19 — https://overview.legal/posts/51951* De Spaanse gegevensbeschermingsautoriteit heeft een boete van 2.000 euro opgelegd aan de ASOCIACIÓN NACIONAL DE TASADORES Y PERITOS JUDICIALES INFORMÁTICOS. De verantwoordelijke partij heeft een gerechtelijke uitspraak gepubliceerd die persoonlijke gegevens van een betrokkene bevatte. Toen de betrokkene probeerde gebruik te maken van zijn rechten, reageerde de verantwoordelijke partij niet adequaat op het verzoek. ### La Prima Srl: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. *Source: Italian Data Protection Authority (Garante), 2025-09-25 — https://overview.legal/posts/52051* De Italiaanse gegevensbeschermingsautoriteit (DPA) heeft La Prima Srl een boete van 10.000 euro opgelegd. Het bedrijf heeft direct marketingberichten verzonden zonder een wettelijke basis en heeft bovendien niet gereageerd op een verzoek van een betrokkene om gebruik te maken van zijn rechten. ### Romoffice Construct Holding Ag SRL: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. *Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 2025-05-13 — https://overview.legal/posts/52281* De Roemeense autoriteit voor gegevensbescherming (DPA) heeft een boete van 2.000 euro opgelegd aan Romoffice Construct Holding Ag SRL. De verantwoordelijke partij heeft persoonsgegevens verwerkt zonder een voldoende juridische basis. ### Dante International SA: Onvoldoende naleving van de rechten van betrokkenen bij de verwerking van persoonsgegevens. *Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 2025-04-24 — https://overview.legal/posts/52301* De Roemeense autoriteit voor gegevensbescherming (DPA) heeft een boete van 10.000 euro opgelegd aan Dante International SA. De verantwoordelijke partij heeft niet adequaat gereageerd op een verzoek van een betrokkene om gebruik te maken van zijn of haar rechten. ### DIGI SPAIN TELECOM, S.L.U.: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. *Source: Spanish Data Protection Authority (aepd), 2025-09-17 — https://overview.legal/posts/52084* De Spaanse autoriteit voor gegevensbescherming heeft Digi Spain Telecom S.L.U. een boete van 150.000 euro opgelegd. De verantwoordelijke partij weigerde de aanvraag voor een contract vanwege vermeende openstaande schulden, hoewel dit niet klopte, aangezien de aanvrager het slachtoffer was van identiteitsfraude. Tijdens het verificatieproces en het besluitvormingsproces met betrekking tot de acceptatie van de aanvraag, werden gegevens verwerkt zonder een voldoende juridische basis. ### Cucina di Fabio S.R.L.: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. *Source: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), 2025-11-26 — https://overview.legal/posts/51937* De Roemeense autoriteit voor gegevensbescherming (DPA) heeft een boete van 3.000 euro opgelegd aan Cucina di Fabio S.R.L. Het bedrijf was actief in direct marketing en gebruikte daarbij persoonsgegevens die niet op een voldoende juridische basis waren verkregen. ### GOHIPOTECA, S.L.: Onvoldoende juridische basis voor de verwerking van persoonsgegevens. *Source: Spanish Data Protection Authority (aepd), 2025-08-29 — https://overview.legal/posts/52135* De Spaanse autoriteit voor gegevensbescherming (DPA) heeft een boete van EUR opgelegd aan GOHIPOTECA, S.L. De verantwoordelijke partij heeft gegevens van een betrokkene verwerkt zonder een voldoende juridische basis. Het contract dat als basis voor de verwerking werd gebruikt, was ondertekend door de echtgenoot van de betrokkene, wat niet voldoende was. De oorspronkelijke boete van EUR 2.000 is verlaagd naar EUR 1.200 vanwege de directe betaling en de erkenning van verantwoordelijkheid door de verantwoordelijke partij. ## Recent developments ### Italian DPA fines Wind Tre EUR 16 700 000 for unlawful telemarketing and data protection infringements *Source: European Data Protection Board, 2026-10-12 — https://overview.legal/posts/595686 — original: https://www.edpb.europa.eu/news/italian-dpa-fines-wind-tre-eur-16-700-000-for-unlawful-telemarketing-and-data-protection_en* Background informationDate of final decision: 05/06/2026National caseController: Wind Tre S.p.A.Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 15 (Right to access by the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller), Article 25 (Data protection by desig ### Italian DPA fines Emirates EUR 180 000 for infringements concerning passengers’ health data *Source: European Data Protection Board, 2026-10-09 — https://overview.legal/posts/593300 — original: https://www.edpb.europa.eu/news/italian-dpa-fines-emirates-eur-180-000-for-infringements-concerning-passengers-health-data_en* Background informationDate of final decision: 14 May 2026National caseController: EmiratesLegal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected from the data subject)Decision: Administrative fine, Compliance orderWebsite topics: Health and research, Basic principlesSummary o ### Italian DPA fines IQVIA EUR 7 000 000 for unlawful processing of patients’ health data *Source: European Data Protection Board, 2026-10-09 — https://overview.legal/posts/593298 — original: https://www.edpb.europa.eu/news/italian-dpa-fines-iqvia-eur-7-000-000-for-unlawful-processing-of-patients-health-data_en* Background informationDate of final decision: 23 September 2026National caseController: IQVIA Solutions Italy S.r.lLegal Reference(s): Article 5 (Principles relating to processing of personal data), Article 9 (Processing of special categories of personal data), Article 13 (Information to be provided where personal data are collected from the data subject), Article 25 (Data protection by design and by default), Article 28 (Processor) and Article 35 (Data protection impact assessment)Decision: Adm ### Italian DPA fines BBVA EUR 5 508 000 for failing to respect a customer’s objection to direct marketing *Source: European Data Protection Board, 2026-10-09 — https://overview.legal/posts/593301 — original: https://www.edpb.europa.eu/news/italian-dpa-fines-bbva-eur-5-508-000-for-failing-to-respect-a-customers-objection-to-direct_en* Background informationDate of final decision: 3 July 2026National caseController: Banco Bilbao Vizcaya Argentaria, S.A., Italian branch (BBVA)Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject), Article 21 (Right to object), Article 24 (Responsibility of the controller)Decision: Administrative fine, Compliance orderWebsite topics: Basic principles, ### The Irish Data Protection Commission fines Google EUR 403 000 000 following Inquiry into Google’s processing of location data *Source: European Data Protection Board, 2026-09-23 — https://overview.legal/posts/354293 — original: https://www.edpb.europa.eu/news/the-irish-data-protection-commission-fines-google-403-000-000-eur-following-inquiry_en* Background informationDate of final decision: 21 September 2026National caseLegal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 12 (Transparent information, communication and modalities for the exercise of the rights of the data subject) and Article 13 (Information to be provided where personal data are collected from the data subject)Decision: Administrative fine, compliance orderKey words: GDPR enforcement, technolog ## Literature ### Data Controller, Processor or a Joint Controller: Towards Reaching GDPR Compliance in the Data and Technology Driven World *Source: SSRN Electronic Journal, 2020-01-01 — https://overview.legal/posts/132509 — original: https://doi.org/10.2139/ssrn.3584207* ### Grounds for Lawful Processing of Personal Data in GDPR and Personal Data Protection Bill 2018, India (PDPB): Section – III: Legal Obligation. *Source: SSRN Electronic Journal, 2019-01-01 — https://overview.legal/posts/132468 — original: https://doi.org/10.2139/ssrn.3720422* ### Grounds for Lawful Processing of Personal Data in GDPR and Personal Data Protection Bill 2018, India (PDPB): Section – VII: Employment Purposes *Source: SSRN Electronic Journal, 2019-01-01 — https://overview.legal/posts/132469 — original: https://doi.org/10.2139/ssrn.3743584* ### Grounds for Lawful Processing of Personal Data in GDPR and Personal Data Protection Bill 2018, India (PDPB): Section – V: Public Interests amp; Exercise of Official Authority. *Source: SSRN Electronic Journal, 2019-01-01 — https://overview.legal/posts/132516 — original: https://doi.org/10.2139/ssrn.3743566* ### Grounds for Lawful Processing of Personal Data in GDPR and Personal Data Protection Bill 2018, India (PDPB): Section – IV: Vital Interests. *Source: SSRN Electronic Journal, 2019-01-01 — https://overview.legal/posts/132471 — original: https://doi.org/10.2139/ssrn.3743565* ## Tools ### CNIL record of processing activities template *Source: CNIL, 2026-07-17 — https://overview.legal/posts/125621 — original: https://www.cnil.fr/en/record-processing-activities* The French DPA's explanation of the Article 30 record-keeping obligation with a simplified downloadable register template aimed at SMEs: one sheet per processing activity covering purposes, data categories, recipients, transfers, retention and security measures. ### ICO documentation templates (records of processing, Article 30) *Source: ICO, 2026-07-17 — https://overview.legal/posts/125620 — original: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/documentation/* Guidance plus downloadable controller and processor documentation templates for the Article 30 record of processing activities: what must be recorded, who is exempt, and spreadsheet templates organisations can adopt directly. ## Related topics - **Personal Data** — https://overview.legal/topics/personal-data Information relating to identified or identifiable natural persons - **Controllers** — https://overview.legal/topics/controllers Entities that determine purposes and means of processing - **Supervisory Authorities** — https://overview.legal/topics/supervisory-authorities National data protection authorities and their powers - **Supervision** — https://overview.legal/topics/supervision Oversight and enforcement by supervisory authorities - **Processors** — https://overview.legal/topics/processors Entities that process data on behalf of controllers - **Consent** — https://overview.legal/topics/consent Freely given, specific, informed indication of data subject wishes --- Generated by overview.legal · https://overview.legal/topics/processing · 2026-10-13