Fiche 8/54 Part I — General Introduction Beginner Reviewed 2026-08-23

The Concept of Processing (Art. 4.2)

Processing covers any operation performed on personal data. From initial collection to ultimate erasure, including mere storage or on-screen viewing, every step constitutes processing under the GDPR.

Open in interactive reader

⚖️ Broad Legal Scope 🏛️ Full Lifecycle Coverage

The Concept of Processing (Art. 4.2)

⚡ In 30 seconds

Under Article 4(2), processing means any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means. The entire lifecycle is captured: collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, restriction, erasure, or destruction.

Active Operations

Collection via web forms, sorting algorithms, automated scoring, API transfers, customer profiling, marketing newsletters.

Passive Operations

Cloud backups, cold data hosting, screen display, system logging, archiving, physical file shredding, database deletion.

⚡ Key Takeaways

Any touchpoint with personal data triggers the application of the GDPR.
Storage limitation (Art. 5.1.e) applies to passive archives: holding data too long is an unlawful processing.
Deletion is itself a distinct processing operation that must be executed securely.

⚠️ Common Pitfall

Believing that data stored on third-party servers without local access relieves the organisation of its controller obligations.

🛠️ In Practice

Document every operational processing step in your Article 30 Record of Processing Activities.

⚖️ Official Sources: Art. 4(2) GDPR · Recitals 15, 16 · CJEU C-101/01 Lindqvist ✓ Legal review: 23 August 2026