Data Protection

Processing

Any operation performed on personal data.

How the laws define this

Every cited framework treats processing as a comprehensive set of operations performed on personal data or personal information, universally covering basic actions such as collection or recording, storage, use or retrieval, disclosure, and destruction. The primary divergence lies in how specifically these laws capture automated systems, technical data flows, and emerging technological applications. Both Organic Act No. 2004-63 on the Protection of Personal Data and Federal Act on Data Protection (FADP) — total revision explicitly establish that processing applies whether or not operations occur by automated means. In contrast, the Personal Information Protection Act explicitly extends the concept to related acts such as de-identification or pseudonymization for research and AI training to set controller obligations. Meanwhile, the Personal Data Protection Act (PDPA) uniquely enumerates operational mechanics like input, output, connection, and internal transmission, whereas the Data Protection Act, 2012 (Act 843) maintains a standard broad baseline without detailing these specific technological activities.

Synthesised from the 5 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
South Korea	Personal Information Protection Act (amendment including provisions on automated decision-making/AI)	In Force	Explicitly lists provision, disclosure, correction, deletion alongside collection, use, storage, and ties processing to lawful bases, controller obligations, and permissible uses like de-identification for AI training.
Taiwan	Personal Data Protection Act (PDPA)	In Force (Amended)	Specifies technical operations like input, editing, replication, retrieval, output, connection, and internal transmission as regulated activities.
Tunisia	Organic Act No. 2004-63 on the Protection of Personal Data	In Force	Emphasizes that operations apply whether or not by automated means, explicitly including organization, adaptation, alteration, consultation, erasure or destruction.
Switzerland	Federal Act on Data Protection (FADP) — total revision	In Force	Adds retrieval explicitly to the standard list of operations performed whether or not by automated means.
Ghana	Data Protection Act, 2012 (Act 843)	In Force	Provides a broad definition plainly limited to collection, recording, organization, storage, adaptation, alteration, retrieval, use, disclosure, or destruction without further elaboration.

What it triggers

In South Korea, processing establishes lawful bases, triggers controller obligations, and permits uses such as de-identification or pseudonymization for research and AI training.source
Under Taiwan's PDPA, all listed processing operations are regulated activities establishing data subject rights and controller obligations.
In Tunisia, processing operations determine the scope of activities subject to the Act's obligations on collection, use, storage, and transfer.
Under Switzerland's FADP, processing triggers strengthened data subject rights aligned with EU GDPR.

Definitions (5)

Any operation or set of operations performed on personal data, including recording, input, storage, editing, correction, replication, retrieval, deletion, output, connection, and internal transmission, all of which are regulated activities under the PDPA.

Personal Data Protection Act (PDPA)Definition 1 of 5

Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, storage, adaptation, alteration, consultation, use, disclosure, erasure or destruction. The definition determines the scope of activities subject to the Act's obligations.

Organic Act No. 2004-63 on the Protection of Personal DataDefinition 2 of 5

Any operation on personal information, including collection, use, storage, provision, disclosure, correction, deletion, and related acts; PIPA defines processing to establish lawful bases, controller obligations, and permissible uses such as de-identification or pseudonymization for research and AI training.

Personal Information Protection Act (amendment including provisions on automated decision-making/AI)Definition 3 of 5

Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, or destruction.

Federal Act on Data Protection (FADP) — total revisionDefinition 4 of 5

Broadly defined to include collection, recording, organization, storage, adaptation, alteration, retrieval, use, disclosure, or destruction of data.

Data Protection Act, 2012 (Act 843)Definition 5 of 5

Not to be confused with

Processor

Processor refers to an entity that processes data on behalf of the controller, while processing is the operation itself performed on personal data.

Data processing

Data processing is synonymous with processing as any operation on personal data, with no meaningful distinction evident.

Questions and answers

What makes processing lawful under South Korea's PIPA?

Processing under South Korea's PIPA establishes lawful bases and permissible uses such as de-identification or pseudonymization for research and AI training. It triggers controller obligations including transparency duties.

Does processing include manual operations?

Yes, definitions in Tunisia and Switzerland explicitly state processing includes operations whether or not by automated means.

What activities count as processing in Taiwan?

Taiwan's PDPA defines processing to include recording, input, storage, editing, correction, replication, retrieval, deletion, output, connection, and internal transmission as regulated activities.