Technical

Data processing

Any operation performed on personal data.

How the laws define this

Regulators uniformly treat data processing as a broad concept spanning virtually any operation performed on data throughout its lifecycle, consistently encompassing core activities such as collection, storage, and use. The primary point of divergence lies in the scope of data subject to regulation and the specific domain applications covered. Both the Organic Law on the Protection of Personal Data (LOPDP) and Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data limit their definitions exclusively to personal data, with LOPDP explicitly noting coverage of AI-driven operations and decisions. Conversely, the Data Security Law of the People's Republic of China broadly governs all data handling activities across lifecycle stages without restricting itself solely to personal records. Similarly, the Data Governance Guide for Media Practice in Kenya (Media Council of Kenya draft) extends its scope to both personal and non-personal data, specifically tailoring its framework to journalistic operations like sourcing, editing, archiving, and dissemination for reporting purposes.

Synthesised from the 4 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
China	Data Security Law of the People's Republic of China	In Force	Broadens to all data handling activities including transmission, provision, and disclosure, explicitly defining lifecycle stages subject to risk management and transfer controls.
Ecuador	Organic Law on the Protection of Personal Data (LOPDP)	In Force	Explicitly covers automated and non-automated operations on personal data, including AI-driven operations and decisions.
Morocco	Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data	In Force	Includes detailed operations like alignment, combination, blocking, and destruction of personal data.
Kenya	Data Governance Guide for Media Practice in Kenya (Media Council of Kenya draft)	Draft	Widens to operations on both personal and non-personal data in journalistic contexts, including sourcing, editing, archiving, and dissemination.

What it triggers

In China, under the Data Security Law, it triggers risk management and transfer controls for data processors.source
In Ecuador, under the Organic Law on the Protection of Personal Data, it establishes rights and obligations for personal data processing including AI systems.
In Morocco, under Law No. 09-08, it establishes protections for personal data processing supervised by the CNDP.
The Data Governance Guide for Media Practice in Kenya sets out ethical data handling and AI risk management for journalists.source

Definitions (4)

Any operation performed on personal data, whether automated or not, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, or erasure; covers AI-driven operations and decisions.

Organic Law on the Protection of Personal Data (LOPDP)Definition 1 of 4

Encompasses the collection, recording, organization, storage, use, analysis, publication, or any other operation performed on personal and non-personal data in journalistic contexts, including sourcing, editing, archiving and dissemination for reporting purposes.

Data Governance Guide for Media Practice in Kenya (Media Council of Kenya draft)Definition 2 of 4

All activities related to handling data, including collection, storage, use, processing, transmission, provision and disclosure. The term defines the lifecycle stages of data subject to the law's obligations and regulatory controls.

Data Security Law of the People's Republic of ChinaDefinition 3 of 4

Any operation or set of operations performed on personal data such as collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, combination, blocking, erasure, and destruction.

Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal DataDefinition 4 of 4

Not to be confused with

Processing

This term is specifically defined in multiple jurisdictions with varying operations, while 'processing' is the general term for any operation on personal data.

Processor

'Processor' refers to the entity performing data processing on behalf of a controller, whereas this term defines the operations themselves.

Questions and answers

What data handling activities are covered under China's Data Security Law?

All activities related to handling data, including collection, storage, use, processing, transmission, provision, and disclosure. These define the lifecycle stages subject to the law's obligations and regulatory controls.

Does data processing include AI operations in Ecuador?

Yes, it covers any operation on personal data, whether automated or not, including AI-driven operations and decisions.

What does data processing mean for media in Kenya?

It encompasses operations on personal and non-personal data in journalistic contexts, including sourcing, editing, archiving, and dissemination for reporting purposes. The guide recommends ethical handling and AI risk management.