Lesson 2.2: Processing and the data life cycle

Module 2 · Lesson 2.2 of 6 · About 30 minutes · Processing and the data life cycle

Processing is not only using data. It covers everything from the moment you ask for it until you delete it. This DPDPA 2023 course page explains processing and the data life cycle in plain language.

processing and the data life cycle - DPDPA 2023 course lesson banner

What you will learn about processing and the data life cycle

Define processing
Walk through the life cycle stages
Attach one duty to each stage

What counts as processing (processing and the data life cycle)

Processing means a wholly or partly automated operation on digital personal data: collection, recording, organisation, storage, adaptation, retrieval, use, sharing, restriction, erasure and destruction.

The life cycle: click each stage

Select a numbered box to read more.

Tap or click a step to see exactly what to do.

Stage and typical tool (processing and the data life cycle)

Stage	Tool example	Risk
Collect	Web form, app, paper form	Over-collection
Store	Database, drive, spreadsheet	Leak
Use	CRM, analytics	Purpose creep
Share	Courier, SMS vendor	Vendor breach
Retain	Backups, archives	Data kept too long
Erase	Deletion script, shredding	Copies left behind

Worked example

An online store collects an address to deliver a parcel (collect), keeps it in its order system (store), shares it with a courier (share), and still holds it five years later (retain). The last stage is where it often goes wrong.

Activity (5 minutes) (processing and the data life cycle)

Draw the six stages for one product or service you offer and note where data sits at each stage.

Key takeaway: Map the whole life cycle. Most breaches and most violations happen in the stages people forget: sharing, retaining and erasing.

Check your understanding of processing and the data life cycle

Q1. Is deleting data a form of processing?

Q2. Which stage carries the erasure duty?

Q3. Sharing with a vendor requires:

← Personal data and digital personal data The Data Principal →

Educational material for learning purposes, not legal advice. Check the official text of the DPDP Act, 2023, the DPDP Rules, 2025 and MeitY notifications for the latest position.

Official sources for processing and the data life cycle: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.