GDPR Data Processing: What Counts, What’s Lawful, and What Isn’t

“Processing,” in GDPR, is not a technical term reserved for databases and algorithms — it is deliberately defined to cover almost anything done with personal data, by almost any means. Writing a colleague’s name in a Slack message, keeping a spreadsheet of client emails, or reviewing CCTV footage all count as processing in exactly the same sense as running a machine-learning model on a customer database. What actually determines whether a given instance is lawful isn’t whether it technically qualifies as processing — it almost always does — but whether it rests on a valid legal basis and follows the principles that apply to every processing operation.

Which Articles Actually Govern Processing

What Counts as Processing

Article 4(2) lists collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination, restriction, erasure and destruction — and the list is illustrative, not exhaustive. It doesn’t matter whether the data is digital or on paper (provided it sits in a structured filing system), automated or entirely manual, or held for years or deleted the same day. If the data relates to an identified or identifiable natural person and something is done with it, that something is processing.

This is why “we’re not really processing it, we’re just looking it up” or “it’s only stored locally, not in a database” are not defences GDPR recognises. Retrieval and consultation are processing operations in their own right, listed alongside storage and collection.

The Six Lawful Bases

Article 6(1) gives exactly six possible bases for ordinary (non-special-category) processing. None is inherently “stronger” than another — the right one is whichever actually reflects the relationship and purpose, chosen before processing starts and not swapped out later because a different basis turned out to be more convenient:

• Consent (a): a freely given, specific, informed, unambiguous affirmative act, the standard set out in Article 7
• Contract (b): processing necessary to perform a contract with the data subject, or to take steps at their request before entering one
• Legal obligation (c): processing required by a law the controller is subject to, such as tax or employment record-keeping rules
• Vital interests (d): processing necessary to protect someone’s life, used narrowly and mainly in emergencies
• Public task (e): processing necessary for a task carried out in the public interest, or in the exercise of official authority
• Legitimate interests (f): processing necessary for a legitimate interest of the controller or a third party, unless outweighed by the data subject’s own interests, rights and freedoms — the only basis that requires a documented balancing test, and the one most often found not to hold up under scrutiny

Special Category Data

Article 9 starts from a default prohibition, not a permission: processing data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used to identify someone, health data, or data about a person’s sex life or sexual orientation is banned unless one of the conditions in Article 9(2) applies. The most commonly used are explicit consent, a legal obligation connected to employment or social security law, vital interests where the person cannot give consent, and substantial public interest grounds set out in national law.

The Clearview AI case below turns on exactly this: biometric identification data is special category data, and neither consent nor an ordinary legitimate-interest balancing test can substitute for one of Article 9’s own conditions.

The Core Principles (Article 5)

Purpose Limitation

Data collected for one purpose can’t quietly be repurposed for an incompatible one later, without a fresh basis or a genuine compatibility assessment.

Data Minimisation

Only the data that is adequate, relevant and limited to what’s necessary for the purpose should be collected in the first place — not gathered “in case it’s useful.”

Storage Limitation

Personal data shouldn’t be kept identifiable for longer than the purpose requires. A retention schedule with actual deletion dates, not an indefinite default, is what this principle expects in practice.

Accountability

Article 5(2) makes the controller responsible for being able to demonstrate compliance with all of the above — not just achieve it. This is the principle behind Article 30 records of processing, and it’s frequently the finding that turns a borderline case into a fine: not lacking a basis, but being unable to show one existed.

Real Fines for Unlawful Processing

Three decisions below show different ways processing goes wrong: no legal basis for the category of data at all, processing that went far beyond what any basis could justify, and a legitimate-interest basis that didn’t survive scrutiny once challenged.

See all processing enforcement cases →

Recitals That Explain This Issue

Checklist: Lawful Processing in Practice

• Identify the specific purpose for a processing activity before it starts, not after — and write it down
• Choose one Article 6 basis per purpose and record why, rather than listing several “just in case” one is later challenged
• If relying on legitimate interests, actually run and document the three-part balancing test — purpose, necessity, and weighing against the individual’s interests
• Check whether any of the data involved falls under Article 9’s special categories before assuming an ordinary Article 6 basis is enough
• Collect only what the purpose actually requires — treat “might be useful later” as a reason to leave a field out, not include it
• Set a real retention period with a deletion trigger, not an indefinite default
• Keep an Article 30 record of processing activities current, including the basis and retention period for each activity
• Train staff who informally collect data about people — HR conversations, customer service notes — on what’s proportionate to record