While the term 'large scale' is used frequently in the GDPR, it is not in fact defined in the regulation but it includes the following concepts:
- duration or permanence of the data processing
- the number or proportion of data subjects
- the volume of data and the range of different data items being processed
- the geographical extent of the processing activity
The following examples have often been used as large-scale processing:
- a hospital (but not an individual doctor) processing patient data;
- tracking individuals using a city’s public transport system;
- a supermarket chain tracking real-time location of its customers;
- an insurance company or bank processing customer data;
- a search engine processing data for behavioural advertising; or
- a telephone or internet service provider processing user data.