GDPR | Data Processing
Guide for proper processing of personal data under GDPR.
Key Terms
| Term | Definition | Example |
|---|---|---|
| Personal data | Any information relating to an identified or identifiable natural person | Name, email, IP address |
| Data subject | Natural person whose data you process | Customer, employee |
| Controller | Determines the purposes and means of processing | Your company |
| Processor | Processes data on behalf of the controller | Cloud provider |
| Processing | Any operation or set of operations performed on personal data, whether or not automated | Collection, storage, use, deletion |
The examples of roles depend on the actual processing: a cloud provider is a processor only where it processes personal data on behalf of the controller. A processor that determines the purposes and means itself is a controller for that processing (Art. 28(10)).
Categories of Personal Data
Standard Personal Data
| Category | Examples |
|---|---|
| Identification | Name, surname, date of birth, national ID number |
| Contact | Email, phone, address |
| Online identifiers | IP address, cookies, device ID |
| Financial | Bank account number, payment card |
| Professional | Employer, position, CV |
| Behavioural | Purchase history, browsing history |
These examples are personal data where they relate to an identified or identifiable person; the context may also reveal special categories.
Special categories (Article 9)
These include racial/ethnic origin, political opinions, religious/philosophical beliefs, trade-union membership, genetic data, biometric data for uniquely identifying a person, health data, and sex life/sexual orientation. Nationality alone is not synonymous with ethnic origin.
Processing requires both an Article 6 legal basis and an applicable Article 9(2) condition, with the required safeguards. Explicit consent is one route, not the only one: specific employment/social-security law, legal claims, healthcare, public health or substantial public interest may apply under their statutory conditions. “Security” alone is not an Article 9 exception. Employee consent may fail the freely-given test due to the power imbalance.
Data Mapping (ROPA)
Records of Processing Activities
Article 30 contains distinct controller/processor records and a limited exception for organisations with fewer than 250 staff; that exception does not cover non-occasional, risky or special-category/criminal-conviction processing. Record each purpose separately. Pseudonymisation does not by itself establish anonymity. Assess identifiability in the context of the processing, including means reasonably likely to be used by the controller or another person (Art. 4(1), (5), recital 26). Data remains personal for a controller able to attribute it to a person using additional information; an assessment concerning a recipient does not remove the controller’s information duties at collection.
Where Article 30 applies, maintain the record for the relevant role in writing, including electronically, and make it available to the supervisory authority on request. The following controller template includes Art. 30(1) fields; the legal basis is an additional practical field.
Processor record (Art. 30(2)): record the name and contacts of each processor and each controller on whose behalf it acts and, where applicable, their representatives and DPO; categories of processing for each controller; applicable transfers with country/organisation identification and the specified Art. 49 safeguards documentation; and, where possible, a general description of Art. 32(1) security measures. This is a distinct record, not a copy of the controller’s purposes table.
ROPA table — example structure, not a retention prescription
| Purpose | Basis to assess | Data minimisation | Retention to record |
|---|---|---|---|
| Order fulfilment | Contract; separate legal duties for accounting | Necessary delivery and payment data | Separate contract-performance data from the specific accounting/tax record |
| Newsletter | Applicable consent/marketing rules | Contact and evidence of the relevant permission | Review on withdrawal/objection and expiry of purpose; justify any evidence retained |
| HR | Specific employment purpose and legal basis | Do not list “all employee data” | Separate personnel, payroll, pension and other records under their own laws and periods |
| Analytics | Actual tool/data flows; ePrivacy/cookie rules as well as GDPR | Avoid unnecessary identifiers | Set and justify a necessary period; no universal two-year rule |
Legal Bases for Processing
Overview of Legal Bases (Art. 6)
| # | Legal basis | When | Example | Caveat |
|---|---|---|---|---|
| 1 | CONSENT (Art. 6.1.a) | Where valid consent is the chosen lawful basis | Freely given, specific, informed and unambiguous | Withdrawable at any time; assess separate marketing/cookie rules |
| 2 | CONTRACT (Art. 6.1.b) | Necessary for a contract with the person or steps at their request before entering into one | Goods delivery, service provision | Only necessary data |
| 3 | LEGAL OBLIGATION (Art. 6.1.c) | Law requires processing | Tax, accounting, social security | Identify the applicable EU or Member State legal basis |
| 4 | VITAL INTEREST (Art. 6.1.d) | Necessary to protect the vital interests of the person or another natural person | Medical emergency | Exceptional situations |
| 5 | PUBLIC INTEREST (Art. 6.1.e) | Necessary for a public-interest task or exercise of official authority vested in the controller | A task entrusted by law | EU/Member State legal basis required; not limited to public bodies |
| 6 | LEGITIMATE INTEREST (Art. 6.1.f) | Necessary for a legitimate interest of the controller or a third party, unless overridden by the person’s interests or fundamental rights and freedoms | Fraud prevention/direct marketing only after assessment | Document necessity and balancing, especially where children are concerned; unavailable to public authorities performing their tasks |
Marketing and cookies also require assessment under the separate ePrivacy rules and their applicable national implementation; the GDPR legal basis alone does not settle permission for the communication or terminal access (Directive 2002/58/EC, Arts. 5(3), 13).
Consent --- Requirements
Valid consent must be:
| Requirement | Description | Wrong example | Correct example |
|---|---|---|---|
| Freely given | Genuine choice without coercion; assess unnecessary conditionality under Art. 7(4) | Making the service conditional on consent to unnecessary processing | A separate optional purpose can be refused without detriment |
| Specific | For a clear purpose | ”I agree to everything" | "I agree to the newsletter” |
| Informed | Understand the processing and the consent choice | No explanation | Identify at least the controller and purposes, explain withdrawal and provide the applicable Art. 13/14 information |
| Unambiguous | Active action | Pre-ticked checkbox | The person actively ticks an initially empty checkbox for the stated purpose |
| Revocable | Withdrawal as easy as giving consent | Hidden or complicated | Link in every email |
Legitimate Interest --- LIA
Legitimate Interest Assessment (balancing test):
Processing Principles
GDPR Principles (Art. 5)
| Principle | Description | Implementation |
|---|---|---|
| Lawfulness, fairness and transparency | Lawful, fair and transparent processing in relation to the person | Legal basis, clear information and review of fair treatment |
| Purpose limitation | Specified, explicit and legitimate purposes; no incompatible further processing | Before another use, assess the Art. 6(4) conditions; Art. 5(1)(b) preserves the Art. 89(1) rule for public-interest archiving, research and statistics |
| Data minimisation | Only necessary data | Audit, delete unnecessary data |
| Accuracy | Data must be correct | Validation, corrections |
| Storage limitation | Not longer than necessary | Retention policy |
| Integrity and confidentiality | Appropriate protection against unauthorised/unlawful processing and accidental loss, destruction or damage | Risk-appropriate technical and organisational measures under Art. 32 |
| Accountability | Demonstrate compliance | Documentation, audit trail |
Transfers outside the EEA and to international organisations
Transfers within the EEA are not transfers to a third country for the purposes of Chapter V; other GDPR obligations remain applicable.
Transfer Mechanisms
| Mechanism | When to use |
|---|---|
| Adequacy decision | Within the territorial, sectoral and recipient scope of the relevant Commission decision. Examples on the Commission list: UK, Switzerland, Japan and, for Canada, recipients subject to PIPEDA (Decision 2002/2/EC, Art. 1) |
| SCCs | Applicable Commission standard contractual clauses, with the required assessment and effective safeguards |
| BCR | Binding corporate rules for a group of undertakings or enterprises engaged in a joint economic activity, approved under Art. 47 |
| Derogations | Only under Art. 49 conditions where Art. 45 adequacy and Art. 46 safeguards are absent; e.g. explicit consent after information on specific transfer risks, or a transfer necessary for the specified contract situation; heed Art. 49(3) restrictions for public authorities |
US Transfers (post-Schrems II)
- EU–US Data Privacy Framework — Decision (EU) 2023/1795, Art. 1, covers transfers to US organisations included in the US Department of Commerce’s Data Privacy Framework List
- Verify the actual recipient’s current participation and coverage for the intended transfer; an adequacy mechanism does not replace the other GDPR conditions
- Where Clauses 14–15 of the applicable SCCs apply to the transfer, document the assessment of third-country laws and practices under Clause 14 of Decision (EU) 2021/914 (often called a TIA). Assess effective additional safeguards where needed, comply with Clause 15 on public-authority access, and suspend transfers if appropriate safeguards cannot be ensured (Clause 14(f)); signing SCCs and completing a form alone are insufficient.
Data Processing Agreements
Mandatory processor-contract content (Art. 28)
Use only processors providing sufficient guarantees under Art. 28(1). Processing must be governed by a contract or other binding legal act under EU or Member State law, in writing including electronically (Art. 28(3), (9)). Specify:
| Item | Required content |
|---|---|
| Processing and parties | Subject matter, duration, nature and purpose, types of personal data, categories of data subjects, and the controller’s rights and obligations |
| Documented instructions | Process only on the controller’s documented instructions, including transfers; exception for EU/Member State law binding the processor, which must inform the controller before processing unless that law prohibits this on important public-interest grounds |
| Confidentiality | Authorised persons commit to confidentiality or are under an appropriate statutory duty |
| Sub-processors | Prior specific or general written authorisation; with general authorisation, notify intended additions/replacements and allow objection. Impose the same data-protection duties by contract/legal act; the initial processor remains fully liable to the controller for the other processor’s performance |
| Security | Take all measures required by Art. 32, appropriate to risk |
| Assistance with rights | Appropriate technical and organisational measures, insofar as possible, to help the controller respond to Chapter III rights, taking account of the processing’s nature |
| Security, breaches, DPIA and consultation | Assist with Arts. 32–36, taking account of the nature of processing and information available to the processor; notify the controller of a personal data breach without undue delay after awareness (Art. 33(2)). A contractual reporting target cannot replace this duty |
| End of services | At the controller’s choice, delete or return the personal data after processing services end, and delete existing copies unless EU/Member State law requires retention |
| Demonstrating compliance and audits | Make all necessary information available and allow/contribute to audits, including inspections, by the controller or its mandated auditor |
| Unlawful instruction | Immediately inform the controller if, in the processor’s opinion, an instruction infringes GDPR or other EU/Member State data-protection provisions |
Retention policy
GDPR Article 5(1)(e) requires storage no longer than necessary for the purpose; it does not prescribe “30 years for all HR data”, “one year for every log” or “72 hours for every CCTV recording”. Specific national records may have their own mandatory periods. Longer storage solely for public-interest archiving, scientific or historical research or statistics is subject to the conditions and safeguards in Art. 5(1)(e) and Art. 89(1).
| Record | Required retention decision |
|---|---|
| Customer/contract data | Purpose, end-of-contract trigger and any separately justified claims/legal-record period |
| HR and payroll records | Exact record category, applicable national provision, start of period and deletion event |
| Accounting/tax documents | Specific statutory document category and period; do not apply one period to all customer data |
| Consent and objections | Evidence necessary to demonstrate the permission/withdrawal and respect suppression; review separately from marketing data |
| Logs and CCTV | Necessary security purpose, risks, access restrictions and shortest justified period |
| Backups | Rotation/deletion schedule and controls preventing erased data from returning to routine use after restoration |
Record the source, owner and review date for each retention rule. A template is completed only after those values have been assessed for the actual processing.
Next Steps
- Data processing understood
- Data subject rights (DSAR)
- Questions to assess your obligations
Content reviewed: 6 September 2026. Primary sources: GDPR — Arts. 3, 5, 6, 9, 12–22, 28–39, 83.
Source versions: GDPR, CS consolidated text including corrigenda (000.003); original act and document history. The consolidation is informative; the published act and applicable corrigenda are authoritative.
Other primary sources: 2002/58/EC, Arts. 5 and 13, version 19 December 2009; 2002/2/EC, Art. 1, version 17 December 2016; 2023/1795, Art. 1; 2021/914, Clauses 14–15; C‑413/23 P, 4 September 2025, paras. 68–120 (Regulation 2018/1725).