software gdpr
Is offline-only processing a &quot;‘processing&quot; as understood by GDPR?
<p><a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">GDPR, article 4, point (1)</a> states:</p>
<blockquote>
<p>‘processing’ means any operation or set of operations which is
performed on personal data or on sets of personal data, whether or not
by automated means, such as collection, recording, organisation,
structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, restriction,
erasure or destruction;</p>
</blockquote>
<p><a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">GDPR, article 6, point 1.</a> states:</p>
<blockquote>
<p>Processing shall be lawful only if and to the extent that at least one
of the following applies:</p>
<p>[...]</p>
</blockquote>
<p>If I develop a pure offline mobile application, do I need to comply with GDPR? Let's say it does ask you for your full name, but only to display your initials. Or something like that.</p>
<p>Alternatively, if I develop a mobile application that <em>does</em> process some personal data on the &quot;backend&quot; (a remote server owned by my company), but some different subset of (potentially more sensitive) personal information is handled purely offline (never leaves the device), do I need to have a lawful basis for processing that data?</p>
<p>I feel that the intention of GDPR is to define &quot;processing&quot; as an action performed by an <em>entity</em> (person, company) either manually or using automated means, when I'm in charge of this data (I can access it, it can be leaked, etc.), so <em>intuitively</em>, offline processing shouldn't be considered &quot;processing&quot; as in GDPR. On the other hand, the definition in Article 4 is so broad that it feels like it does include offline processing.</p>

<p>The GDPR only applies to data processed by you on your computer. Any processing that happens on the user's device is the user's responsibility, not yours.</p>

<p>It is important in this context to determine who the <em>Data Controller</em> is. This role is defined in Art 4(7) (highlight mine):</p>
<blockquote>
<p>‘controller’ means the natural or legal person, […] which, alone or jointly with others, <strong>determines the purposes and means of the processing</strong> of personal data; […] the controller or the specific criteria for its nomination may be provided for by Union or Member State law;</p>
</blockquote>
<p>Since you as the app developer clearly control the means of processing, you are the data controller. The means you have chosen is “offline processing” which is a strong safeguard and drastically simplifies your compliance, but it is still processing under your control. Who controls the processing is more important than where and how the processing is performed.</p>
<p>The only scenario I can envisage in which you would not be the data controller is if someone else is the data controller, and you are their data processor per Art 28.</p>
<p>I have written more in-depth analysis on this issue
in <a href="https://law.stackexchange.com/a/54846">my answer to <em>Does the GDPR appy to the data subject's computers?</em></a>.
The ECJ's ruling on the Fashion ID case is useful to determine when someone is a (joint) controller, even if they do not have access to the data being processed.</p>

<h2>Processing does not have to be by computer</h2>
<p>Purely paper based records are also subject to the GDPR.</p>
