Processing

Legal Framework

The concept of "processing" is the foundational regulated activity under the GDPR. Article 2(1) establishes the material scope, applying the Regulation to both automated and non-automated processing of personal data forming part of a filing system. Once processing falls within scope, Article 5 sets the governing principles — lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity/confidentiality — with an explicit accountability requirement:

"The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1"
— GDPR Art. 5

Article 30 operationalises accountability by requiring both controllers and processors to maintain records of processing activities, documenting purposes, data categories, recipients, transfer arrangements, retention periods, and security measures. Article 10 imposes additional restrictions on processing criminal-conviction data, permitting it only under official authority or authorising Union or Member State law with appropriate safeguards.

Key Developments

The CJEU has reinforced that documentation obligations under Article 30 are procedural duties distinct from the lawful-basis analysis under Article 6(1). In UZ v Bundesrepublik Deutschland, the Court clarified that compliance with Article 26 (joint-controller arrangements) and Article 30 (records) does not itself constitute a ground for lawfulness:

"compliance by the controller with the obligation laid down in Article 26 of the GDPR to conclude an arrangement determining joint responsibility for processing and the obligation to maintain a record of processing activities laid down in Article 30 of that regulation is not among the grounds for lawfulness of processing"
— UZ v Bundesrepublik Deutschland ¶59

Enforcement authorities have applied these requirements rigorously. The Belgian DPA found a legal-information website's privacy notice deficient because it referenced "our services" and "legal obligation" without specifying which services or legislation applied — treating vagueness as non-compliance with the transparency principle. The Irish DPC, in its investigation of the Midlands Regional Hospital Tullamore, scrutinised whether submitted SOPs genuinely satisfied Article 30's record-keeping requirement, noting that documents lacking explicit "Record of Processing Activities" labelling could still qualify if substantively adequate.

The Croatian DPA's action against an IT services company illustrates that processors bear direct security obligations: the failure to implement appropriate technical measures against foreseeable risks constituted a breach independent of the controller's obligations.

Status of the Debate

This topic is contested in court. While the core definition of processing is well-established, its outer boundaries remain actively litigated — particularly regarding the allocation of controller versus processor responsibility, the sufficiency of Article 30 records, and the interplay between documentation obligations and substantive lawfulness requirements. The CJEU's ruling in UZ v Bundesrepublik Deutschland settled the question that Article 30 compliance does not cure a missing lawful basis, but divergent national-level decisions on what constitutes an adequate record of processing activities continue to generate uncertainty. What would resolve the open questions is a definitive CJEU ruling on the minimum substantive content threshold for Article 30 records and on the boundary between processor autonomy and controller instruction under Article 28(3).

Practical Guidance

• Maintain a structured Article 30 record for every processing activity, documenting all seven elements listed in Article 30(1) — purpose, data categories, recipients, transfers, retention, and security measures. Vague references to "legal obligation" or "applicable administrative obligations" without specificity have been found insufficient by DPAs.
• Establish a lawful basis under Article 6(1) before relying on documentation: compliance with Article 30 does not substitute for a valid legal ground. Confirm the basis independently.
• Instruct processors in writing on the boundaries of permissible processing; processors must not exceed the controller's documented instructions, and both parties must maintain separate Article 30 records.
• Apply Article 5 principles as design constraints: data minimisation, storage limitation, and security should be engineered into each processing operation from inception, not retrofitted.
• For special-category data such as criminal convictions under Article 10, verify that processing occurs solely under official authority or is authorised by specific Union or Member State law providing appropriate safeguards — generic lawful bases are insufficient.