What counts as “processing personal data” under GDPR?

Here's the thing: under GDPR, "processing" doesn't just mean actively using data. It's virtually every action performed on personal data, whether you're thinking about it or not.

The official list is long. It includes collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, and destruction. For email marketers, that means importing a subscriber list counts. Sending a campaign counts. Segmenting subscribers by behavior counts. Even just viewing subscriber records in your database counts. All of it is processing.

Why does GDPR cast such a wide net? Because it's trying to cover the entire lifecycle of data from the moment you collect it until it's permanently gone. That imported list sitting in your database? You're processing it by storing it. You're processing it by keeping it secure. You're processing it by maintaining backups. This applies even if you haven't touched the data in months.

The key processing activities for email marketers are collecting addresses through signup forms, storing preferences and consent records, sending campaigns, tracking engagement metrics, and syncing data with CRMs or other platforms. Each one requires a lawful basis (like consent or legitimate interest) before you can do it.

If you're handling EU subscriber data in any way, you're processing it. No exceptions. That's not being dramatic. It just means you need GDPR compliance measures in place, including a documented reason for each processing activity, security safeguards, and a way to honor subscriber requests to access or delete their data. Start by auditing what you're actually doing with subscriber data. Write it down. That list is your processing inventory, and it's the foundation for your compliance plan.