Processing of personal data

Processing of personal data refers to everything that can be done with a piece of data. For example, processing includes simply storing or viewing data. GDPR identifies 16 types of personal data processing.

1. Collection
   Typically represents the first processing action and involves acquiring the data itself.
2. Recording
   Involves storing the data on any medium.
3. Organisation
   Classification of data according to a specific criterion.
4. Structuring
   Distribution of data based on certain schemes.
5. Storage
   Keeping data stored on any medium, including paper.
6. Consultation
   Simply viewing personal data, even accidentally or without a specific purpose.
7. Alteration
   Refers to changing personal data, even in a minimal way.
   1. Processing
      A specific case of modification, representing a process by which personal data undergoes substantial changes.
   2. Selection
      Identifying personal data within groups of data already stored.
8. Extraction
   Extracting data from already stored groups.
9. Alignment
   Comparing data, which may be a consequence of processing, selection, or consultation.
10. Use
    A generic activity that may represent any type of use of personal data.
11. Combination
    Using multiple databases through electronic tools.
12. Restriction
    Temporarily suspending any processing of data except for storage.
13. Disclosure
    Sharing or disclosing personal data to one or more specific entities other than the data subject, data controller, processor, and authorized individuals.
    1. Transmission
       An extension of communication, representing the transfer of entire databases to other entities, such as in the case of selling or purchasing data lists or when one company acquires or succeeds another.
14. Dissemination
    Making personal data available in any form and manner, whether voluntarily or not, to unspecified individuals. An example is publishing a photograph online, which without the data subject’s consent remains unlawful processing.
15. Erasure
    Deleting data using electronic tools.
16. Destruction
    The activity of permanently deleting data from any medium.
    

Every processing of personal data must comply with the principles defined by the Regulation (Article 5):

• Lawfulness
  Processing must comply with the Regulation, rely on a legal basis, and, if required, be based on the data subject’s consent.
• Fairness
  The final outcome of the processing must be correct.
• Transparency
  The data subject must be informed about the processing of their data and has the right to request access to it at any time.
• Purpose Limitation
  Current and future processing must be limited to the purpose for which it is related.
• Data Minimisation
  Data must be “adequate, relevant, and limited to what is necessary for the purposes for which they are processed.” Therefore, unnecessary data must not be collected or processed. Where possible, for the achievement of the purpose, anonymized or pseudonymized data should be used. Data minimization must be ensured from the design of the processing itself (Privacy by Design and by Default).
• Accuracy
  Data must be accurate, updated, and corrected if incorrect. This obligation does not authorize the data controller to access new information in order to update previously collected data.
• Storage Limitation
  Data has an expiration date depending on the purpose for which it is processed, beyond which it must be deleted. Alternatively, data may be anonymized, losing its characteristic of being “personal.”
• Integrity and Confidentiality
  Adequate security of the collected and processed personal data must be ensured.