Processing
Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction (Art. 4(2) GDPR).
The list is illustrative, not exhaustive, and the concept is as broad as that of personal data itself: simply viewing a record, holding it in an archive, pseudonymising it, anonymising it, transferring it to a vendor or deleting it are all processing operations, each of which needs a legal basis and must respect the principles. Automated processing includes AI model training and inference; manual processing is covered when the data forms part of a filing system.
For life sciences organisations, the width of the definition means that the record of processing activities must capture the full lifecycle of trial, patient and employee data, not only the initial collection. It also means that seemingly technical steps (a CRO running a query, a central lab storing residual samples with identifiers, a statistician pooling datasets, a cloud provider taking backups) are processing operations that must be allocated to a controller or processor and reflected in contracts. Each purpose of processing, rather than each system, is the unit of analysis in a DPIA.
