What does 'Large Scale' mean in the context of the GDPR?

While the term 'large scale' is used frequently in the GDPR, it is not in fact defined in the regulation but it includes the following concepts:

  • duration or permanence of the data processing
  • the number or proportion of data subjects
  • the volume of data and the range of different data items being processed
  • the geographical extent of the processing activity

The following examples have often been used as large-scale processing:

  • a hospital (but not an individual doctor) processing patient data;
  • tracking individuals using a city’s public transport system;
  • a supermarket chain tracking real-time location of its customers;
  • an insurance company or bank processing customer data;
  • a search engine processing data for behavioural advertising; or
  • a telephone or internet service provider processing user data.
Nick is the author of this solution article.

Did you find it helpful? Yes No

Send feedback
Sorry we couldn't be helpful. Help us improve this article with your feedback.