Data processing

What is data processing?

According to Article 4(2) of the General Data Protection Regulation (GDPR), data processing is "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction."

The GDPR simplifies the handling of data processing compared to the former Federal Data Protection Act (BDSG-old) and makes it easier for companies to understand the subject through the definitions provided in the legal text. Differences in the regulations regarding data processing depend on which categories of personal data are being processed.

Principles of data processing under the GDPR

Companies must first and foremost understand that data protection applies to every processing operation involving personal data. The GDPR is just as clear regarding the general principles for processing data as it is with its definitions. According to Article 5(1) of the GDPR, the following principles apply to every processing operation:

• Lawfulness
• Fairness
• Transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality

In addition, the controller is accountable for compliance with these principles.

Processing as a key term in data protection

Since May 25, 2018, all companies have been confronted with the terminology of personal data processing. Because this entails specific requirements and legal consequences, companies should generally view any activity involving personal data as processing and adhere to the data protection framework. This topic remains highly relevant, especially in light of the high fines that can be imposed under the GDPR. Before data can be collected and further processed, consent for its collection, use, and further processing is mandatory.

Electronic data processing

Electronic data processing refers to a company's IT systems. Although this is not explicitly related to data protection in principle, (automated) processing plays a significant role in data protection law. This triggers the material scope of the GDPR (see Article 2(1) GDPR). Data and information can be collected in analog form (e.g., files) or digitized (automated) as files via IT systems (computers, email, software, etc.). If you require expert support for your company in this area, your data protection officer can provide comprehensive assistance.

Data processing as a special form

When data is processed on behalf of another company, the controller and the processor must enter into a separate data processing agreement (DPA). The content of this agreement must meet the requirements of Article 28(3) of the GDPR. Typical applications for this include call centers, external payroll accounting, and much more.

Data processing in corporate groups

Corporate groups do not enjoy special privileges when it comes to the internal exchange of personal data. Data transfers between companies within the same group require a legal basis just as much as transfers between unrelated companies. Recital 48 of the Regulation merely mentions that there may be a legitimate interest in transmitting customer and employee data within a group of companies for internal administrative purposes. However, there is no such thing as a "group privilege" in data protection law that would eliminate the need for a legal basis for data transfers.