What counts as processing

By the end of this lesson you can recognise "processing" as nearly anything done with personal data, and explain why even holding or deleting data is covered.

Why it matters

People often think the rules only apply when they actively "use" data, such as sending a marketing message. The law is far wider. If holding, viewing, copying, sharing and deleting all count, then the duties apply from the moment data arrives until the moment it is gone. Knowing this stops the common and costly belief that "we only store it, we do not do anything with it, so the rules do not apply to us."

The idea in plain words

Processing is any action taken on personal data. Collecting it is processing. Writing it down is processing. Storing it on a server is processing, even if nobody ever opens the file. Looking at it is processing. Sharing it, correcting it, blocking it, and deleting it are all processing.

Think of handling someone's property. Whether you pick it up, move it to a shelf, lend it to a friend, or throw it away, you have handled it, and you are responsible for how you did so. Data is the same. Every touch counts, including the last one.

Collect Store Use Share Retain Delete all "processing"

From the first moment data is collected to the moment it is deleted, every step is processing, and every step is covered.

Processing: any operation performed on personal data, whether or not by automated means: collecting, recording, organising, storing, adapting, retrieving, consulting (that is, viewing), using, disclosing, sharing, combining, restricting, erasing or destroying it. This wide definition is set out in GDPR Article 4(2) and mirrored in Nigeria's Data Protection Act.

See it done

A charity runs a weekly food programme. Trace its handling of one family's details and label each step.

1. A volunteer writes the family's name and needs on a sign-up sheet. Processing (collecting).
2. The sheet is typed into a spreadsheet on a laptop. Processing (recording and storing).
3. A manager opens the spreadsheet to plan deliveries. Processing (consulting and using).
4. The list is emailed to a partner charity. Processing (disclosing and sharing).
5. A year later the file is deleted. Processing (erasing).

Every step, start to finish, is processing. So the charity's duty of care runs across the whole life of that data, not only at the moment it sends out food.

Your turn, with help

Say whether each is processing.

1. Keeping an old customer database on a hard drive that nobody has opened in two years.
2. Shredding a stack of paper application forms.

Hints: Does storing count even when idle? Is destroying data an operation on it?

Your turn, alone

1. A staff member glances at a colleague's HR file out of curiosity and closes it again. Processing or not?
2. Backing up a customer list to a second server. Processing or not?
3. Sorting a mailing list alphabetically. Processing or not?

Watch out

• "We only store it" is not a defence. Storing is processing, and the duties apply the whole time.
• Viewing is processing. Looking at a record you have no business reason to see can itself be a breach of the rules.
• Deleting is processing too, so it must be done properly and securely, not left half-done on forgotten backups.

Say it back

1. Give three actions that count as processing.
2. Is simply holding data, untouched, processing?
3. Why does it matter that deleting counts as processing?

What is next

Now you know what is done, to whom, and by whom. Next we step back to the bigger question underneath all of it: privacy as a human right, and the gap between what the law allows and what is actually right.