Large Scale Processing

What Is Large Scale Processing?

Certain requirements in the GDPR are dependent on whether the data processing in question takes place on a “large scale.” 

What constitutes large-scale processing varies by jurisdiction. Some nations have used fixed figures or portions of the overall population as thresholds. For example, the Czech Republic has defined it as the processing of the data of 10,000 people or more, while Germany set a threshold of 5 million (or 40% of a relevant population). 

Other nations, such as Ireland and the UK, have a more subjective approach. In such jurisdictions, an organization should consider the following factors:

• The number of data subjects concerned
• The volume of personal data being processed
• The range of different data items being processed
• The geographical extent of the activity
• The duration or permanence of the processing activity

For example, a small doctor’s office probably isn’t processing data on a large scale, but a hospital probably is. A single retailer may not meet the criteria, but if they operate branches in multiple cities or countries, they should consider the question more carefully.