Skip to main content
Glossary termPublished inNormenkader IBP

Processing

Also known as verwerking, verwerken

What does "processing" mean under the GDPR?

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Defined in / by

Last updated: 14 October 2026.

Everything you do with the data counts

The definition has no threshold. Reading a pupil's file on screen is consultation, keeping last year's class lists on a shared drive is storage, and shredding them is destruction. Each is processing, and each needs a lawful basis under Article 6 and a purpose under Article 5. The phrase "whether or not by automated means" brings paper into scope too, although Article 2(1) limits non-automated processing to data that form part of a filing system or are intended to.

The list after "such as" is a set of examples, not a closed catalogue. An operation the list does not name, such as training a model on pupil essays, is still processing if it is performed on personal data.

For a Dutch school board the term matters in two places. The privacy half of the Normenkader IBP, 25 norms, asks the board to know which processing it does and why. And Article 30 turns that knowledge into a written record: the record of processing activities lists each processing, its purpose and its recipients.

Questions and answers

Is storing personal data without using it processing under the GDPR?

Yes. Article 4, point (2), of the GDPR names storage as an example of processing. Data a school keeps in an archive or a backup is being processed for as long as it is kept, so the GDPR's rules on purpose, retention and security apply throughout.

Does the GDPR's definition of processing cover paper records?

Partly. The definition covers operations "whether or not by automated means", but Article 2(1) applies the GDPR to non-automated processing only where the data form part of a filing system or are intended to. A structured paper pupil file is in scope; a loose note usually is not.

Regulations

  • Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)

    The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.

    Next
    Every board knows its position against the Normenkader through a self-evaluation, and has a plan to meet all norms