Cybersecurity Policy Report, Spanish Privacy Agency Considers When Processing Subject to GDPR Begins, (Apr 30, 2026)

By Tony Foley

Citing a recent decision by the Spanish Supreme Court, the Spanish data protection authority, Agencia Española de Protección de Datos (AEPD), said in a Tuesday blog post that the concept of “processing of personal data” under the European Union’s General Data Protection Regulation (GDPR) was not limited to actions subsequent to the data being obtained but also applied to actions occurring prior to obtaining the data.

The post explains that in the case before the Supreme Court, a request by a public administration for data relating to the health of an employee was questioned. The person, who was asked to provide diagnosis and medical treatment data to justify work absences, did not provide the data, leading to a question of whether it could be said that data processing was being undertaken with respect to the request. The National High Court had found that the existence of treatment of the requested data could only be considered in the case of actual collection, but the Supreme Court adopted a different interpretation.

Specifically, AEPD said, the court referred to the broad definition of “processing” under GDPR article 4, saying that the concept of processing encompassed “any operation or set of operations carried out on personal data,” indicating a desire to create an extensive scope for the GDPR. In particular, the court stressed that it was not possible to interpret the concept of processing in isolation but in relation to the principles of data processing under GDPR article 5 and the requirement for controllers to incorporate data protection by design and by default under GDPR article 25.

Considering these factors, AEPD said the court opined that the obligations of the controller did not begin with the receipt of data but rather arose beforehand, at the time when the controller decided which data was going to be requested, for what purpose, and by what means. Accordingly, the court said, data processing already existed when the public administration asked the person to hand over personal data, even if, in the end, the requested data was never delivered.

AEPD said that legal consequences of this analysis were immediate; if the request is already part of the processing, then the principles of GDPR article 5, in particular the data minimization requirement, are enforceable from the moment the request is made. Logically, the court said, this means that the actions of the controller prior to the reception of the data also are subject to compliance with GDPR principles. The court was careful to clarify that the controller is required to examine, prior to obtaining the data, whether the data are adequate, relevant, and limited to what is necessary related to the stated purpose of collection. Consequently, the court concluded that a request for personal data is not a neutral or preliminary act but is a part of an activity designed, planned, and ordered to obtain data, which fully integrates it into the concept of processing.

“In short, the ruling consolidates a clear message for data controllers, such as that it is not enough to comply with the GDPR once the data has been collected: the requirement of compliance is prior, it must begin before, that is, at the same time that the processing is designed, understanding the purposes of the processing and the data that is intended to be collected,” the post concludes. “In this way, we can conclude that the request for data is part of the concept of processing, although without excluding—the judgment does not do so—that it must comply with Article 5 of the GDPR prior to such action, as would be the case at the time when the controller designs the processing.”

News: InternationalLegislation DataPrivacy GDPR LitigationEnforcement