Processing
Any wholly or partly automated operation performed on digital personal data.
Processing means doing almost anything with personal data: collecting it, storing it, using it, sharing it or deleting it. If you handle personal data at all, you are very likely processing it.
Meaning of Processing
The Act lists collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure, dissemination, restriction, erasure and destruction. In practice, almost everything done to personal data counts as processing, including simply storing it.
Section 2 defines "processing" in relation to personal data as a wholly or partly automated operation or set of operations performed on digital personal data. It includes collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction. The list is illustrative, so an operation that is not named can still be processing if it is automated and acts on personal data.
Two features of the definition deserve attention. First, it covers the full life cycle, from the first collection to the final deletion. Even deleting data is processing, which is why the Act expects erasure to be done safely and recorded. Second, it covers passive handling. A company that stores backups of customer records and never opens them is still processing, because storage is named in the list.
The definition connects to the Act's scope in Section 3, which applies to processing of digital personal data within India, and to processing outside India in connection with offering goods or services to people in India. Purely personal or domestic processing and publicly available data falling in Section 3(c) are outside the Act. The word "automated" refers to digital means capable of operating automatically in response to instructions, so manual notes on paper are not covered unless they are digitised.
Processing differs from collection alone, sharing alone and profiling alone, each of which is one kind of processing. It also differs from a "specified purpose", which is the reason for processing. Whoever decides the purpose and means is the Data Fiduciary, while whoever performs the operations on the fiduciary's behalf is the Data Processor. The same operation can therefore be called processing by both of them, with different responsibilities.
Examples of Processing
Collecting an email address at sign-up, storing it, using it to send receipts and deleting it later are all processing.
A fashion store collects names and addresses at checkout, stores them in its database, uses them to ship orders and later deletes inactive profiles. Each of these actions is processing, and the notice should cover all of them.
A diagnostic lab scans a patient's prescription, saves it in a cloud folder and shares the report through an app. Scanning, storage and transmission are separate operations, and the cloud provider handling storage is a Data Processor.
An HR department keeps employee details in a spreadsheet, adds performance ratings to it, and exports it to a payroll vendor each month. Combining the data, exporting it and sharing it with the vendor are all processing activities.
Why Processing matters
Because the definition is so wide, nearly every business activity that touches an individual's digital data triggers the Act: running a payroll file, operating a CCTV system with digital storage, running an email campaign, resetting a password, or analysing website logs. Obligations such as notice, consent or another lawful ground, security safeguards, accuracy, retention limits and breach reporting all attach to processing.
A company cannot escape duties by saying it merely stores data or only passes it to a vendor. Under Section 8(1), the Data Fiduciary remains responsible even for processing done on its behalf by a Data Processor. Penalties of up to ₹250 crore for failing to maintain reasonable security safeguards show the cost of treating passive handling as low-risk.
How it works in practice
- 1Draw a data-flow map that follows personal data through its whole life: where it comes from, where it is stored, who can see it, where it is sent, and when it is deleted. Each step is a processing operation that needs a lawful ground and a purpose.
- 2For each operation, record the specified purpose, the lawful ground under Section 4 (consent or a legitimate use in Section 7), the system involved and the retention period.
- 3Separate the operations you perform yourself from those performed by vendors, such as cloud hosting, SMS gateways, payment processors and analytics providers. Put a valid contract in place for each, as Section 8(2) requires, and apply the Rule 6 safeguards.
- 4Apply data minimisation at each step. Do not collect fields you do not need, do not keep copies in personal spreadsheets, and do not combine datasets for a new purpose without checking the notice and consent.
- 5Plan the end of the cycle. Erase data when the purpose is served or consent is withdrawn, unless a law requires retention, and instruct processors to do the same under Section 8(7).
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Believing that only active use counts. Storage, backup and archiving are processing under the Act.
Thinking deletion is outside the Act. Erasure is itself a processing operation and should be carried out securely and logged.
Assuming outsourcing moves the responsibility to the vendor. The fiduciary stays accountable under Section 8(1) for processing by its processors.
Treating paper registers as covered. The Act applies to digital personal data, but paper that is later scanned or typed in becomes covered once digitised.
Compliance tips
Keep one living register of processing activities, with owners, purposes, grounds, systems and retention for each.
Review the register whenever you launch a feature, change a vendor or merge datasets, since new operations may need a new notice.
Ask every vendor to describe in writing which operations it performs on your data, and compare this to your register.
Train staff that exports, screenshots, chat shares and email attachments of customer data are all forms of processing and fall under company policy.
Common questions about Processing
Is storing data without using it still processing?
Yes. The Act lists storage among the operations that make up processing. A company that holds customer records in a database or backup is processing them, so it must protect them with reasonable security safeguards and delete them when the purpose has been served.
Is deleting personal data also processing?
Yes. Erasure and destruction are named in the definition. That is why a company should delete in a controlled way, record what was deleted and make sure processors erase their copies when a Section 8(7) trigger occurs.
Does processing include paper records?
The Act applies to digital personal data, including personal data collected in non-digital form and then digitised. A handwritten register that is never digitised is outside the Act, but once its contents are typed or scanned into a system, the processing rules apply.
What is the difference between processing and collection?
Collection is one kind of processing. Processing is the umbrella that includes collection, storage, use, sharing, alteration and deletion. A company can therefore comply at the point of collection and still fall short when it later uses or shares the same data.