white_paper_on_data_protection_in_india_171127_final_v2

CHAPTER 5: WHAT IS PROCESSING?
5.1 Introduction
Having discussed the term personal data, it is important to demarcate actions performed on
such data which would be the primary subject matter of the law. A compendious term that is
used to address any action involving data is the term ―processing‖. To give the broadest
possible protection, data protection laws across the globe have tried to develop definitions of
data processing in such a manner that they cover all the associated activities that are
performed on data. These are considered below.
5.2 Issues and International Practices
(i)
Processing of Personal Data
European Union
The EU GDPR defines ‗processing‘ as any operation or set of operations which is performed
on personal data or on sets of personal data, whether or not by automated means, such as
collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or otherwise making available,
alignment or combination, restriction, erasure or destruction. This definition explicitly refers
to most activities that can be performed on data. It also covers both manual and electronic
processing. 249
United Kingdom
The UK DPA defines processing 250 as the means for obtaining, recording or holding the
information or data or carrying out any operation or set of operations on the information or
data, including organisation, adaptation, alteration, retrieval, consultation, disclosure by
transmission, dissemination or otherwise making available, alignment, combination, blocking,
erasure or destruction of the information or data. This definition follows closely from the
Data Protection Directive definition but does not explicitly cover manual data processing.
The UK Data Protection Bill, 2017 follows the EU GDPR definition of processing 251 and
defines both in an inclusive and exhaustive sense, by covering any operation or set of
operations, which are performed on personal data, or on sets of personal data, such as:
collecting, recording, organising, structuring, storing, adapting or altering, retrieving,
consulting, using, disclosing by transmission, disseminating or otherwise making available,
aligning, combining, restricting, erasing or destroying.
249 Article 4(2), EU GDPR.
250 Section 1(1), UK DPA.
251 Section 1(4), UK Data Protection Bill, 2017.
44