Processing under GDPR: What Counts in Plain Terms?

Quick Answer: Processing under GDPR is any operation on personal data, including collecting, viewing, storing, sharing and deleting it. Automated records qualify, and systematically filed paper records can qualify too. A business should identify each activity's purpose, lawful basis, necessary data and record-keeping position before treating a customer list as outside the rules ^1,2.

Summary in a mind map

Processing under GDPR: What Counts in Plain Terms?
│
├─ Start with the operation
│   ├─ Collecting, viewing and storing all count
│   └─ Deletion is also an operation on personal data
│
├─ Check the record medium
│   ├─ Automated personal records fall within scope
│   └─ Systematic paper files can fall within scope
│
├─ Test permission and limits
│   ├─ Name the purpose before choosing an Article 6 basis
│   └─ Limit data, access and storage to what is needed
│
└─ Keep an explainable account
    ├─ Show how Article 5 principles shape the activity
    └─ Check every Article 30(5) exception before relying on size

What is the GDPR definition of processing?

A garden centre can map processing without starting with software. Its checkout collects a customer's name for an order. A member of staff reads the order, a stockroom colleague retrieves it, and the firm later deletes it. Each action is an operation on personal data. The legal definition in Article 4(2) covers operations whether or not automated. It expressly includes collection, recording, organisation, storage, retrieval, consultation, use, disclosure, restriction, erasure and destruction ¹.

Start with the activity. An order may move between a till, a paper collection slip and an email inbox. The medium changes, but the organisation still decides what information it needs and what happens to it. That is why an inventory that lists only applications can miss work at counters and in filing cabinets. This is a method for applying the definition, rather than an additional legal category ^1,2.

This table does not say that every listed operation is lawful. Definition and permission are separate questions. Naming an operation tells the team that it needs to examine the purpose, applicable basis and principles. It cannot use the absence of a visible edit as evidence that nothing happened to the data ^1,3.

Scope for your organisation

The first scope question is whether the information relates to an identified or identifiable person. The EDPB lists names, phone numbers, client numbers, booking references and purchase history as examples. A garden centre's named delivery record is plainly different from an anonymous count of bags of compost sold. A customer number can still identify someone indirectly when the firm can connect it to a person ².

Next ask whether the organisation and activity fall within the Regulation's reach. The EDPB explains that it may apply to organisations established in the EEA and to certain organisations outside it offering goods or services to people in the EEA or monitoring their behaviour. The answer is about the real establishment and activity, not merely the currency or language shown on a website. This article addresses the meaning of processing, so a cross-border case needs its own scope assessment ².

Article 2(1) covers processing wholly or partly by automated means. It also covers non-automated personal data that are part of, or intended to become part of, a filing system. That distinction matters when a business has both a checkout database and a paper order book. The fact that a task is manual does not decide the issue by itself ¹.

Size is no shortcut. The scope question concerns the data, the organisation and the operation. A small garden centre may have few staff yet still maintain a searchable customer database; staff numbers do not erase the definition in Article 4(2) ^1,2.

Nor does a job title settle it. The person at the counter, the stockroom worker and the manager may touch the same record for different tasks. Describe what each actually does, then decide which access is necessary for the stated purpose ^1,4.

Storage and viewing count

Yes. Article 4(2) names both storage and consultation. An employee looking up a customer's address to resolve a delivery question is consulting personal data, even if the screen closes without a change. A dormant mailing list is being stored, even if no campaign was sent this month. The law's wording leaves no requirement for a download, edit or external disclosure before an operation counts ¹.

That conclusion changes how a small team frames permissions. Instead of asking only who can export records, ask who can open them. The purpose of a delivery task may justify showing a driver an address while giving no reason to show the same worker the customer's full purchase history. Article 5(1) requires personal data to be adequate, relevant and limited to what is necessary for the purposes. The EDPB's design-and-default guidance applies that idea to the amount processed, storage and accessibility ^1,4.

Storage needs its own decision. An archive is still storage. The organisation should be able to say why it still needs the data, who can reach the archive and what event ends retention. Those are practical questions flowing from purpose limitation and data minimisation. They do not create one universal retention period for every order or customer relationship ^1,4.

Paper records and software

The law draws a scope line for manual records, not a blanket paper exemption. Article 2(1) includes non-automated processing when the personal data form part of a filing system or are intended to do so. The EDPB illustrates this with paper files organised systematically, such as an alphabetic filing cabinet. A garden centre that files customer cards by surname should therefore examine the cards as well as its till records ^1,2.

A loose handwritten note needs a closer test. Context matters. Its physical existence alone does not prove that it is part of a filing system; nor does writing on paper make it safe to ignore when the note will be filed later. Ask how staff find it, whether it is indexed and whether the business intends to put it into an organised record. Those questions follow the wording “form part of” or “intended to form part of” in Article 2(1) ¹.

The same order may cross both media. Staff might print an online order, mark a paper picking sheet, then update a digital dispatch record. Each step should appear in the description of the activity, because it changes where data sit and who can consult them. Map the hand-off. A process map is more useful than a choice between “paper” and “digital” departments ^1,2.

The lawful basis comes first

Article 6(1) permits processing only if, and to the extent that, at least one listed basis applies. The six routes are consent, necessity for a contract, a legal obligation, vital interests, a public-interest task and legitimate interests. The EDPB explains that controllers need an appropriate basis and that the choice has consequences for conditions and rights. A business should name the purpose first, then test the basis against that purpose ^1,3.

Suppose a customer buys compost and asks the garden centre to deliver it to their home. If the address is necessary to fulfil that customer contract, Article 6(1)(b) may support using it for the delivery; the EDPB says contract-based processing must be necessary for performance ^1,3. If staff later use that address to send unrelated promotions, delivery necessity does not carry over. That second purpose needs its own basis assessment before use ³.

Consent is not a catch-all. The EDPB states that it must be freely given, specific, informed and unambiguous. Withdrawal matters. If an organisation must process data and cannot genuinely allow withdrawal, that is a signal to assess whether another basis fits. Conversely, choosing a basis simply because it is administratively convenient cannot make an unnecessary activity necessary ³.

Evidence and limits

Article 5(1) requires lawful, fair and transparent processing, specified and legitimate purposes, and data that are adequate, relevant and limited to what is necessary. The EDPB also says organisations must be able to demonstrate compliance with the principles. A useful activity entry therefore identifies its purpose, data types, people with access, basis, storage point and end condition. That entry is a practical way to explain a decision, not a substitute for the legal test ^1,2.

A short evidence table makes Article 5 checks visible for this customer journey ^1,2.

The formal record duty has a narrower size rule than many summaries suggest. Article 30(5) exempts an enterprise or organisation with fewer than 250 people only unless the processing is likely to risk individuals' rights and freedoms, is not occasional, includes special categories, or concerns criminal convictions and offences under Article 10. A routine customer workflow may fail the “occasional” condition. Staff count alone is therefore insufficient to decide whether the Article 30 record is required ¹.

This page cannot determine the right lawful basis for an unknown activity, whether a particular paper note is in a filing system, or whether a particular firm's Article 30 exception applies. Facts decide those points. The decisions turn on the actual purpose, organisation of records and pattern of processing. The definition supplies the questions; the business supplies the facts ^1,3.

What to do next

Take one ordinary customer journey and follow the data from first collection to final deletion. Write one row for each point where staff collect, view, store, change, share or remove information. Record the purpose and the minimum data needed at that point. Compare the resulting list with the Article 4(2) operations, then assess the Article 6 basis and Article 30 position for the activity ^1,3.

If you need a broader account of responsibility for these choices, read GDPR accountability. For the choice of basis itself, use what a lawful basis means. Those pages can deepen the analysis after the activity has been described in plain terms.

If the activity includes an AI tool, the English comparison of local and cloud language models gives further technical context. Keep the processing assessment tied to the data and operation actually used.