Automated processing refers to the processing of personal data by means of technical systems, particularly computers, software or digital applications. This includes, for example, the automatic storage, organisation, analysis or transmission of personal data. The General Data Protection Regulation (GDPR) covers such operations under Article 2(1) and Article 4(2) GDPR. In this context, companies must comply in particular with the principles of data processing, the requirements for lawfulness and data security.
When does automated processing of personal data take place?
Automated processing takes place when personal data is processed wholly or partly by automated means using technical systems.
Under Article 4(2) GDPR, the term “processing” includes, among other things, the collection, recording, organisation, storage, adaptation, retrieval, use, disclosure by transmission and erasure of personal data.
Typical examples include:
- Automatic storage of customer data in an online shop
- Electronic processing of employee data in HR software
- Automated collection and analysis of website usage data
- Storage and synchronisation of personal data in cloud systems
- Automatic sending of personalised emails based on stored customer data
Processing does not have to be entirely autonomous. Operations in which employees initiate or monitor individual processing steps may also fall within the scope of automated processing.
In addition, the GDPR also applies to certain non-automated processing operations where personal data forms part of a filing system or is intended to form part of one.
What data protection requirements apply to automated processing?
Companies must comply with the general requirements of the GDPR when carrying out automated processing.
Under Article 5 GDPR, the following principles apply in particular:
- Lawfulness: Processing requires an appropriate legal basis under Article 6 GDPR.
- Purpose limitation: Personal data may only be collected for specified, explicit and legitimate purposes.
- Data minimisation: Only personal data necessary for the relevant purpose may be processed.
- Accuracy: Personal data must be accurate and, where necessary, kept up to date.
- Storage limitation: Personal data must generally not be stored for longer than is necessary.
- Integrity and confidentiality: Data must be protected by appropriate security measures.
In addition, controllers must take account in particular of the information obligations under Articles 13 and 14 GDPR and the rights of data subjects under Articles 15 et seq. GDPR.
The use of automated software does not, in itself, constitute a legal basis for processing personal data.
What security measures are required for automated processing?
Under Article 32 GDPR, controllers and processors must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.
Possible security measures include, in particular:
- Encryption of personal data
- Access restrictions and access authorisation policies
- Regular data backups
- Measures to ensure the availability and resilience of systems
- Regular testing and evaluation of the security measures implemented
The measures required depend in particular on the nature of the processing, the state of the art and the risks to the rights and freedoms of data subjects.
Under Article 25 GDPR, companies must also take account of the principles of data protection by design and data protection by default.
What is the difference between automated processing and automated decision-making?
Automated processing and automated decision-making are not legally equivalent.
In automated processing, personal data is processed using technical systems. One example is the automatic storage of a customer order.
Automated decision-making, by contrast, occurs when a technical system makes a decision based on processed data.
Article 22 GDPR lays down specific rules for decisions based solely on automated processing, including profiling, which produce legal effects concerning data subjects or similarly significantly affect them.
Such decisions are generally permitted only under the conditions set out in Article 22(2) GDPR. Depending on the circumstances, additional safeguards must be provided, including the possibility of contesting the decision and expressing one's point of view.
Not every form of automated data processing is therefore subject to the specific requirements of Article 22 GDPR.
When is a data protection impact assessment required?
Under Article 35(1) GDPR, a data protection impact assessment is required where a type of processing is likely to result in a high risk to the rights and freedoms of natural persons.
This may be the case, in particular, where personal aspects are systematically and extensively evaluated on the basis of automated processing, including profiling, and the evaluation serves as the basis for decisions that produce legal effects or similarly significantly affect individuals.
However, a data protection impact assessment is not required for every instance of automated processing.
The decisive factors include, in particular, the nature, scope, context and purposes of the processing, as well as the associated risks.
Companies must therefore assess, before deploying the relevant systems, whether the requirements of Article 35 GDPR are met.
Practical example: Automated processing in an online shop
An online retailer uses a digital customer management system. As soon as a customer places an order, their contact details, delivery address and order information are automatically stored in the system.
The software then forwards the necessary information to the relevant internal departments and supports the further processing of the order.
This constitutes automated processing of personal data within the meaning of the GDPR.
The online retailer must ensure that an appropriate legal basis exists for the processing. Article 6(1)(b) GDPR is particularly relevant for data required to perform the contract.
In addition, the company must implement appropriate security measures and fulfil its statutory information obligations.
legal data assessment: Companies should assess the data protection compliance of automated processing operations as early as the introduction of new software. In addition to an appropriate legal basis, particular importance should be attached to data minimisation, clearly defined access permissions and appropriate security measures. Where systems use personal data to assess or make decisions about individuals, companies should also examine the requirements governing automated decision-making and the possible need for a data protection impact assessment.
Legal basis
Articles 2(1), 4(2), 5, 6, 13–15, 22, 25, 32 and 35 GDPR.
Frequently asked questions about automated processing
What does automated processing mean?
Automated processing refers to the processing of personal data, wholly or partly by automated means, using technical systems. Examples include the electronic storage, analysis and transmission of personal data.
Does all electronic data processing constitute automated processing?
The processing of personal data using electronic systems will generally fall within the definition of automated processing. It is not necessary for every processing step to take place without human involvement.
Is automated processing permitted under the GDPR?
Yes. Automated processing is generally permitted provided that the statutory data protection requirements are met. These include, in particular, an appropriate legal basis under Article 6 GDPR and compliance with the principles set out in Article 5 GDPR.
What is the difference between automated processing and profiling?
Automated processing encompasses various technical processing operations. Profiling is a specific form of automated processing under Article 4(4) GDPR in which personal data is used to evaluate or predict certain personal aspects relating to an individual.
Does automated processing always require a data protection impact assessment?
No. Under Article 35 GDPR, a data protection impact assessment is required in particular where the processing is likely to result in a high risk to the rights and freedoms of natural persons.
Related terms.
Artificial intelligence and data protection When artificial intelligence is used, the GDPR applies whenever personal data is processed in training, in the input or in the output. Art. 6 GDPR Data protection impact assessment (DPIA) A Data Protection Impact Assessment (DPIA) is a legally required process for assessing and mitigating risks associated with the processing of personal data. Under Article 35 of the General Data Protection Regulation (GDPR), the controller must carry out a DPIA where a planned processing operation is likely to result in a high risk to the rights and freedoms of natural persons. The aim is to identify data protection risks at an early stage and establish appropriate safeguards. 