Processing Definition

GLOSSARY

Published by a ��Ƶ Commercial expert

What does Processing mean?

Processing means obtaining, recording, holding, or carrying out any operation on personal data. It includes organisation or alteration; retrieval or use; disclosure and anonymisation, blocking or destruction. Most operations in relation to personal data will constitute processing.

Commercial

View the related checklists about Processing

MVNO agreement—checklist

MVNO agreement—checklist This Checklist covers some of the main provisions to be included in a mobile virtual network operator (MVNO) agreement under which a mobile network operator supplier will provide wholesale access services to an MVNO for resale to its own retail customers. It covers some of the main provisions that are specific to an agreement of this kind. See also the Precedent: MVNO agreement. In this Checklist, the following definitions are used: • Agreement—means the MVNO agreement between the MVNO and the Supplier for the provision of the Services • End-User—means a customer of the MVNO • IPR—means intellectual property rights • MVNO—means mobile virtual network operator, the customer in the Agreement • Services—means the wholesale network services being provided to the MVNO by the Supplier • Supplier—means the mobile network operator providing network services to the MVNO The third column can be used to record observations or comments as the Checklist is worked through. Checklist Further information Notes (if any) General terms and conditions ☐ Consider duration....

Contractual considerations for the procurement of artificial intelligence—checklist

Contractual considerations for the procurement of artificial intelligence—checklist This Checklist highlights the key procurement, licensing and contractual issues relevant to artificial intelligence (AI) or machine learning (ML) solutions. Depending on the specific application, the inclusion of AI may mean adding simple automated functionality, through to creating a complex, intelligent tool controlled by either a third party or by the customer. This Checklist assumes that the AI will be capable of an element of learning and that, as such, one or both of the parties will be involved in training it. For a discussion of methodologies for the management of risks and challenges that might arise during the deployment of AI technology, see News Analysis: Understanding and managing the risks in artificial intelligence (AI) technology projects. General issues related to software development and licensing, systems integration, outsourcing and software support services may also be relevant, depending on the solution, but are not highlighted in this Checklist. For more, see Practice Notes: • Key issues in software licence agreements • Software development...

EU GDPR—personal data breach notification—flowchart

EU GDPR—personal data breach notification—flowchart The EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) is directly applicable and fully enforceable in EU and EEA states. This Flowchart focuses on personal data breach notification under the EU GDPR. It covers: • a summary of the overarching obligations • key guidance • types of personal data breaches • the flowchart of notification requirements • general examples of personal data breaches and who to notify • detailed examples of personal data breaches and who to notify The EU GDPR includes the following definition of a personal data breach: ‘…a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.’ Overarching obligations In summary, among other things, the EU GDPR provides that: • data processors must notify the data controller without undue delay after becoming aware of a personal data breach • unless the personal data breach is unlikely to result in a risk to the rights...

Information security flowchart—law firms

Information security flowchart—law firms Information security has become a business-critical issue. It is not something you can tackle in isolation as there are obvious overlaps with cyber security and data protection. This flowchart sets out a logical process for reviewing and addressing your information security requirements. The notes below the flowchart signpost relevant Templates. Note 1: identify information See Precedent: Information audit form. Alternatively, you may already hold all relevant data in a Data processing register, in which case there is no point duplicating the exercise. Note 2: assess information risks See Precedent: Data protection risk assessment—short form. Alternatively, you may have already undertaken a detailed Data protection risk assessment, which may be adequate for your purposes. Note 3: secure the information See Precedent: Information security review, which encourages you to conduct a comprehensive review of your procedural and

Notification offences under the Data Protection Act 1998 [Archived]

Archived: This Practice Note has been archived and is not maintained.This Practice Note is intended for use where a notification offence was committed before 25 May 2018. Where a notification offence occurred before 25 May 2018, it may still be prosecuted under Data Protection Act 2018 (DPA 1998) despite the fact that the legislation has been repealed. Notification offences under DPA 1998 cannot be committed after 25 May 2018. There are no equivalent notification offences under Data Protection Act 2018 (DPA 2018) so that a notification offence could only have been committed historically and prior to 25 May 2018 when DPA 1998 was in force. For information on the data protection offences created by DPA 2018, see Practice Note: Offences under the Data Protection Act 2018.Notification required under the Data Protection Act 1998Note these offences cannot be committed after 25 May 2018.Failure to notify the Information CommissionerDPA 1998 required data controllers who processed personal data to register their processing with the Information Commissioner for the purposes of the register maintained...

Rights of data subjects under the DPA 1998 [Archived]

ARCHIVED: This archived Practice Note provides information on the data protection regime before 25 May 2018 and reflects the position under the Data Protection Act 1998 (DPA 1998). This Practice Note is for background information only and is not maintained.Changes as a result of the General Data Protection RegulationThe General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR) (applicable from 25 May 2018) introduces substantial amendments to EU and UK data protection law and replaces the DPA 1998 and Directive 95/46/EC (the Data Protection Directive) from that date.For further information, see Practice Notes: Introduction to the EU GDPR and UK GDPR and Rights of data subjects.A data subject is a living individual who is the subject of personal data, ie data from which he can be identified. For key definitions under the DPA 1998, see Practice Note: Key definitions under the DPA 1998. For a comprehensive introduction to the GDPR, collating key practical guidance, see: Data protection toolkit.Right of access to personal dataAn individual has a right to be informed...

Discover our 1591 Practice Notes on Processing

Information management and security—annual review

Information management and security—annual review 1 General information Date of review [insert date of review] Person(s) conducting review [insert name or role, eg data protection officer] 2 Review and findings Have you conducted a fresh information audit form or checked that your Data processing register is up to date? Yes/NoIf no, ensure you set an action point at section 3 below Have you conducted a fresh data protection risk assessment? Yes/NoIf no, ensure you set an action point at section 3 below Have you conducted an updated information security review? Yes/NoIf no, ensure you set an action point at section 3 below Are the below polices up to date and fit for purpose?• information security • Records management policy • version control and document management policy • clear desk and clear screen policy • Remote working and removable media policy • bring your own device (BYOD) • password Yes/NoIf no, please describe any changes needed and ensure you set an action point at section 3 below...

Accounts procedures for fee earners and support staff 2011 [Archived]

Accounts procedures for fee earners and support staff 2011 [Archived] 1 This document sets out our [accounting OR finance] systems and controls for fee earners and support staff. 2 Basic principles 2.1 We have an overriding duty to protect client money and assets. 2.2 To ensure compliance with this duty and with the SRA Accounts Rules 2011 (the rules), all fee earners and support staff must comply with the systems and procedures set out in this document. 3 Accounts department 3.1 The [Accounts OR Finance] department is located at [insert location, eg office if you have more than one office or location within your office] and is led by [insert name and/or title], [who is also the firm’s Compliance Officer for Finance and Administration (COFA)]. 3.2 [insert any other information regarding the structure of your accounts departments, eg if you have different teams for different functions]. 4 Accounts system 4.1 We have a central accounting [and time recording] system called [insert name...

Dive into our 335 Precedents related to Processing

Can an insurer refuse to provide internal correspondence and case notes relating to an insurance claim where a subject access request (SAR) is made under the UK GDPR for such information?

Can an insurer refuse to provide internal correspondence and case notes relating to an insurance claim where a subject access request (SAR) is made under the UK GDPR for such information? This Q&A assumes that the organisation that has received the SAR is a ‘controller’ of the relevant data. For an introduction to the United Kingdom General Data Protection Regulation, Retained Regulation (EU) 2016/679 (UK GDPR) regime, including key data protection terms and concepts, such as ‘personal data’, 'processing', 'data subject' and ‘controller’, see: Data protection toolkit. As further explained in Practice Notes: The UK GDPR and DPA 2018 for insurers and Data subject rights—access, Article 15 of the UK GDPR gives individuals a right to obtain confirmation from a data controller as to whether or not personal data concerning them is being processed, and where it is, access to the personal data and certain further information. A request for such information is commonly known as a ‘subject access request’ (or a 'SAR' or 'DSAR'). In order to assist...

What should I consider if my client wishes to apply under Tier 2 but the sponsor licence is yet to be granted?

What should I consider if my client wishes to apply under Tier 2 but the sponsor licence is yet to be granted? Can my client apply for leave to remain under Tier 2 even though a new sponsor’s licence has not yet been granted? If an application is lodged under the Immigration Rules pertaining to Tier 2 and a decision is made without your client being in possession of a Certificate of Sponsorship (CoS), you will need to advise your client that it will fall for refusal. If the client’s leave is due to expire shortly and they have been offered a job which will qualify under Tier 2 by an employer that needs to obtain a sponsor licence, it is important to make a request to the Sponsor Licensing Unit for the licence application to be expedited. You should ask for the application to be decided by, or in advance of, the date that the individual’s leave is due to expire. Can I ask the...

See the 367 Q&As about Processing

Comment—Meta, Google and more seek clarity on AI model training under EU privacy law

MLex: Meta Platforms, Microsoft, Google and X have all suspended the training of generative AI models in the EU over personal data protection concerns, and they are hoping that watchdogs there will soon provide legal clarity on how the EU General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) applies to model training. Until European data protection authorities reach a consensus, particularly over the use of 'legitimate interest' as a legal basis for data processing, tech companies will stay away.

A follow-up to the new EDPB guidelines on the scope of the ‘cookie rule’

EU Law analysis: James Clark, Verena Grentzenberg and Heidi Waem, partners at DLA Piper, analyse the final version of the European Data Protection Board (EDPB) Guidelines 2/2023 on the technical scope of Article 5(3) of Directive 2002/58/EC, the ePrivacy Directive. They consider how the EDPB interprets the ‘cookie rule’, the technologies within scope, and practical implications of the Guidelines.On 7 October 2024, after public consultation, the EDPB adopted the final version of its ‘Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive’—the so-called ‘cookie rule’ (the Guidelines).

Read the latest 4085 News articles on Processing

Speed up all aspects of your legal work with tools that help you to work faster and smarter. Win cases, close deals and grow your business–all whilst saving time and reducing risk.

Case studies

"We rely on ��Ƶ to give us a definitive answer, quickly and reliable every time so that we can be confident in the advice we use to help our clients."

Shelter

Access all documents on Processing

GET ACCESS NOW

Top

Trial

��Ƶ

GLOSSARY