Personal data processing means any operation performed on personal data: collecting, recording, organizing, storing, modifying, retrieving, using, disclosing, sharing, or deleting it. Under the GDPR, the term is broad on purpose, because risk can arise at any step in the data lifecycle, not just when data is stolen.
In cybersecurity, this matters because many controls are really processing controls. Access logs, cloud backups, AI training pipelines, analytics dashboards, and support tickets may all involve personal data processing and therefore need a lawful basis, clear purpose, access limits, and retention rules. Attackers often target processing systems to exfiltrate, reuse, or monetize personal data, while defenders reduce exposure by minimizing collection, encrypting stored records, segregating environments, and making consent or opt-out settings easy to audit. In products like smart devices and AI services, the way data is processed can become a security and compliance issue at the same time.