Who Does the GDPR Apply To?

Even if you have a general idea of what the GDPR is (if not, you can read about it here), one question remains: who does data protection cover?

Who does the GDPR apply to? Does data protection cover your business?

The GDPR applies to anyone who processes another person’s personal data. You do not need to deal with personal data if you do not use other people’s data. Using personal data is what is known as data processing.

Is saving personal data the same as processing it? Does processing happen when an email is sent? What is the subject of data processing?

Personal data processing means any operation performed on personal data. Examples include:

1. Collection;
2. Recording;
3. Organization;
4. Storage;
5. Retrieval;
6. Consultation; and
7. Other uses of personal data.

If you collect data, you are already processing it. If an employee at your company views customer data, they are processing it. The same is true if they later call or email those customers. For simplicity, you can assume that almost any action you take with data is processing, including deleting it.

Five legal bases for processing data, the GDPR’s “golden five”: when can I use someone’s personal data?

Data processing is a broad concept covering many ways of using data. Does that mean you can take anyone’s personal data and start using it? No.

You need a legal basis to use another person’s personal data. The GDPR specifies five such bases, referred to here for ease of recall as the “GDPR golden five”:

1. Consent of the data subject: if someone consents to the use of their personal data, it may be used on that basis.
2. Processing is necessary to exercise a right or meet an obligation under law. For example, personal data may be processed for accounting purposes on the basis of the Accounting Act.
3. Processing is necessary to enter into a contract. If you want to enter into a contract with someone, you generally need their data to prepare and then perform the contract.
4. Processing is necessary to perform tasks carried out in the public interest or in the exercise of official authority. For example, public authorities use personal data to prepare voter lists so people can vote.
5. Processing is necessary for legitimate interests pursued by the controller or a recipient, provided that the data subject’s rights and freedoms are not overridden. This basis is the most difficult to demonstrate and may also be useful, for example, for a company’s marketing.

Each basis calls for an appropriate way of working, a procedure that can be implemented in a business.

Eight principles of personal data processing

Having a legal basis is not enough. If someone has consented to the processing of their data, can you then do whatever you want with it? No.

Data processing covers a wide range of activities. The GDPR sets out general principles that provide a framework for processing. Data may therefore be processed on an appropriate legal basis, the “golden five” described above, and in accordance with these principles:

1. Lawfulness;
2. Fairness and transparency;
3. Purpose limitation;
4. Data minimization;
5. Accuracy;
6. Storage limitation;
7. Integrity and confidentiality; and
8. Accountability.

At first, these principles may seem like legal jargon, but each represents a practice a business should implement, for example through suitable procedures or documents.

Who processes personal data? Controllers and processors

The GDPR defines personal data and sets out the legal bases and principles for using it. To complete the picture, it is also necessary to identify who processes the data. This makes clear who must follow the principles described above.

The most important party in the personal data processing chain is the controller. The controller determines the purposes and means of processing, and is often the party that collected the data and decided how it would be used.

In practice, a company that runs an online store and collects data from customers and users, such as people who sign up for its newsletter, will be the controller. The company decides how to process the data, for example by sending advertising emails.

Another important party is the processor. A processor handles personal data on behalf of the controller. An accounting office is a good example: it receives personal data from clients, such as employee information, to calculate salaries or taxes for the controller. The processor does not decide what to do with the data and may not use it for its own purposes.

Processing personal data in a business

If your business collects personal data from users or customers, it processes that data. In that case, it should meet the GDPR requirements concerning legal bases and processing principles, maintain the relevant records of processing, sign data-processing agreements and ensure that the necessary authorizations are in place.