“Processing” under Article 4 (2) of the GDPR means doing something with an individual’s personal data, such as collecting, recording, disclosing, altering, consulting with or simply storing the personal data. A data controller who processes personal data must only process the required data for the specific purpose of fulfilling the objectives for which the data was initially gathered and processed. For example, if you engage a food delivery service, they will require certain information from you to enable them perform the service you requested from them and your data can be processed for that purpose alone.

However, further processing is where a data controller has used the data subject’s personal data for another reason than the initial reason they received it. For example if the food delivery driver contacts you after the food has been delivered for any reason other than about the delivery of the food, then that constitutes further processing of your personal data and it is the data controller’s responsibility to ensure that does not happen.