---
title: "Processing"
description: "Processing under the GDPR, Article 4(2): any operation on personal data, automated or not, from collection and storage to erasure or destruction."
canonical: "https://gencompl.ai/glossary/processing-gdpr"
language: "en-US"
type: "Glossary term"
published: "2026-10-14T18:22:20.852Z"
modified: "2026-10-14T19:21:05.817Z"
---

# Processing

‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

Also known as: verwerking, verwerken

**What does "processing" mean under the GDPR?**

Defined in: [Normenkader IBP](https://gencompl.ai/regulations/normenkader-ibp)

[Home](https://gencompl.ai/) › [Glossary](https://gencompl.ai/glossary) › Processing

> ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;

## Defined in / by

- [GDPR (32016R0679)](https://eur-lex.europa.eu/eli/reg/2016/679/oj), Article 4, point (2)

Last updated: 14 October 2026.

## Everything you do with the data counts

The definition has no threshold. Reading a pupil's file on screen is consultation, keeping last year's class lists on a shared drive is storage, and shredding them is destruction. Each is processing, and each needs a lawful basis under Article 6 and a purpose under Article 5. The phrase "whether or not by automated means" brings paper into scope too, although Article 2(1) limits non-automated processing to data that form part of a filing system or are intended to.

The list after "such as" is a set of examples, not a closed catalogue. An operation the list does not name, such as training a model on pupil essays, is still processing if it is performed on [personal data](https://gencompl.ai/glossary/personal-data).

For a Dutch school board the term matters in two places. The privacy half of the Normenkader IBP, 25 norms, asks the board to know which processing it does and why. And Article 30 turns that knowledge into a written record: the record of processing activities lists each processing, its purpose and its recipients.

> **What we could not establish**
>
> This entry fixes the term as the GDPR words it. It does not decide whether a given processing at your school or organisation meets the Regulation; that is a question for your data protection officer or counsel.

## Questions and answers

### Is storing personal data without using it processing under the GDPR?

Yes. Article 4, point (2), of the GDPR names storage as an example of processing. Data a school keeps in an archive or a backup is being processed for as long as it is kept, so the GDPR's rules on purpose, retention and security apply throughout.

### Does the GDPR's definition of processing cover paper records?

Partly. The definition covers operations "whether or not by automated means", but Article 2(1) applies the GDPR to non-automated processing only where the data form part of a filing system or are intended to. A structured paper pupil file is in scope; a loose note usually is not.

## Sources

- [Regulation (EU) 2016/679 (General Data Protection Regulation)](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679) (EUR-Lex · 4 May 2016)
- [Normenkader IBP: begrippenlijst](https://normenkaderibp.kennisnet.nl/begrippenlijst/) (Kennisnet)

## Related content

### Regulation

- [Normenkader Informatiebeveiliging en Privacy (Normenkader IBP)](https://gencompl.ai/regulations/normenkader-ibp): The Normenkader IBP is the Dutch framework of 69 information security and 25 privacy norms for primary, secondary and special education. Each school board must know where it stands by 1 January 2027 and meet maturity level 3 on every norm in 2030. It is a policy agreement, not an act.