Processing personal data

Processing personal data means doing anything with it: any action taken with information that can identify a living person. The person the data is about is called the data subject.

Processing covers a whole chain of actions, including:

• collecting it, such as asking for details on a sign-up form
• storing it, whether on paper, on a computer or in the cloud
• using it, for example looking up a customer's order
• sharing it with another organisation
• deleting it once it is no longer needed

Even small actions count. Opening a record, correcting a phone number or printing a list are all ways of processing personal data.

The law applies to organisations

In the UK, the Data Protection Act 2018 and UK GDPR work together as the current law. Any organisation that processes personal data, from a corner shop to a secondary school, must follow the data protection principles. These include processing data lawfully, collecting it only for the stated purpose, collecting only what is needed, keeping it accurate, keeping it only as long as necessary and protecting it.

The principles are legal requirements, not optional good practice. An organisation that ignores them can be investigated by the Information Commissioner's Office (ICO) and fined. For example, a youth football club collects players' names and medical conditions on registration forms, keeps them in a spreadsheet, uses them to contact parents about matches and deletes them when a player leaves. Each of those steps is processing, so each must follow the principles, such as asking only for the information the club genuinely needs.

Where the data is stored does not matter

The law follows the data wherever it is held: on a shop till, on a staff laptop, in paper files or in cloud storage, even when the cloud service runs on servers in another country. Moving data into the cloud does not pass responsibility to the cloud provider. The organisation that collected the data stays responsible for looking after it, so it should check how securely the provider stores and protects it.