Processing
Any operation performed on personal data.
How the laws define this
Every cited framework treats processing as a comprehensive set of operations performed on personal data or personal information, universally covering basic actions such as collection or recording, storage, use or retrieval, disclosure, and destruction. The primary divergence lies in how specifically these laws capture automated systems, technical data flows, and emerging technological applications. Both Organic Act No. 2004-63 on the Protection of Personal Data and Federal Act on Data Protection (FADP) — total revision explicitly establish that processing applies whether or not operations occur by automated means. In contrast, the Personal Information Protection Act explicitly extends the concept to related acts such as de-identification or pseudonymization for research and AI training to set controller obligations. Meanwhile, the Personal Data Protection Act (PDPA) uniquely enumerates operational mechanics like input, output, connection, and internal transmission, whereas the Data Protection Act, 2012 (Act 843) maintains a standard broad baseline without detailing these specific technological activities.
Synthesised from the 5 statutory definitions below. Each one is quoted in full, with its source.
Definitions (5)
Any operation or set of operations performed on personal data, including recording, input, storage, editing, correction, replication, retrieval, deletion, output, connection, and internal transmission, all of which are regulated activities under the PDPA.
Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, storage, adaptation, alteration, consultation, use, disclosure, erasure or destruction. The definition determines the scope of activities subject to the Act's obligations.
Any operation on personal information, including collection, use, storage, provision, disclosure, correction, deletion, and related acts; PIPA defines processing to establish lawful bases, controller obligations, and permissible uses such as de-identification or pseudonymization for research and AI training.
Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or destruction.
Broadly defined to include collection, recording, organization, storage, adaptation, alteration, retrieval, use, disclosure, or destruction of data.
Related Terms
Data processing
Any operation performed on personal data....
Processing for training
Collection and retention of personal data to train ML models....
Processor
Entity that processes data on behalf of the controller....
Personal information processor
Entity determining purposes and means of personal data processing....
Processor (Encargado)
Entity that processes data on behalf of a controller....