The PDPL has the following definition of processing of personal data.
Article 1 (5) of the PDPL
Any operation carried out on personal data by any means, whether manual or automated, including collecting, recording, saving, indexing, organizing, formatting, storing, modifying, updating, consolidating, retrieving, using, disclosing, transmitting, publishing, sharing, linking, blocking, erasing and destroying data.
Processing is taking any action on personal data. For example, even if you only hold personal data (store personal data), you will be considered as processing it – even if no further action is taken on it.
In essence, this means that any use of personal data is considered processing of personal data. Its use is subject to the provisions of the PDPL.
Example | Processing of personal data | Personal data collection
An online store requires customers to register on its website to purchase products. The customers have to specify their names, emails, logins, passwords and delivery addresses.
When the customer provides the above personal data to the website, it is considered to be collected by the online store.
Example | Processing of personal data | Personal data storage
A manufacturing company has a large database of all its employees. The database includes the personal data of employees, including their names, contact information and education qualifications. The company has contracted a cloud service provider to store the database of the employees in the cloud.
Storage of such personal data in the cloud is processing of personal data. It is regulated by the
You must ensure that processing is conducted in a manner that is fair, lawful, and transparent and in accordance with the principles of the PDPL. For more information on the principles of the PDPL, please see the section “Data protection principles” of this Guidance.