Processing gets a broad interpretation in Section 1 of POPIA.
As soon as you get near information about a person, it is safe to assume that you are “processing” it. Or for those who prefer more formal definitions: processing is any operation or activity or any set of operations, concerning personal information, whether digital or physical, automatic or manual.
POPIA, in other words, applies to the ‘full life-cycle’ of personal information: from its creation, collection, storage, usage, transfer and amendment to its destruction.
POPIA supports the concept of ‘privacy by design’ – data processors need to respect privacy from the very first step in the life-cycle of personal information, to the very last.
POPIA Definition
Processing means any operation or activity or any set of operations, whether or not by automatic means, concerning personal information, including—
- (a) the collection, receipt, recording, organisation, collation, storage, updating or modification, retrieval, alteration, consultation or use;
- (b) dissemination by means of transmission, distribution or making available in
any other form; or - (c) merging, linking, as well as restriction, degradation, erasure or destruction of information;
