s.2 · s.4
Processing
Processing means any wholly or partly automated operation on digital personal data, from collecting and storing it through sharing and using it to erasing and destroying it.
The list in Section 2 is long on purpose: collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure, dissemination, restriction, erasure and destruction. If a system touches the data, that is processing.
The breadth matters because Section 4 allows processing only for a lawful purpose and only on one of two grounds, consent or a listed legitimate use. A business cannot store data on one ground and use it on another; each operation needs its footing.
Questions people ask
- Is merely storing data processing?
- Yes. Storage is on the list, so keeping data past its purpose is processing without a ground, which is why Section 8(7) and Rule 8 require erasure.
- Is reading a CV that someone emailed us processing?
- Yes, and Section 7(a) usually supplies the ground: the person provided the data voluntarily for that purpose.
Related terms
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.