The General Data Protection Regulation (GDPR), formally known as Regulation (EU) 2016/679, establishes clear definitions and guiding principles for the processing of personal data. Understanding these terms is essential for controllers, processors, and stakeholders to ensure compliance and accountability. Below we explore the meaning and applicability of five key concepts: Processor, Official Authority, Public Interest, Principle of Proportionality, and Undue Delay.

1. Processor (GDPR, Article 4(8))

A Processor is defined as:

“A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.”

Key Points:

• A processor acts only under the controller's instructions.
• Examples include IT service providers, cloud hosting companies, payroll service providers, or outsourced call centers.
• Processors have direct legal obligations under GDPR, such as maintaining records of processing activities, implementing appropriate technical and organizational measures, and assisting the controller in fulfilling data subject rights.

Practical Example:

A hospital (controller) outsources patient data storage to a cloud service provider (processor). The provider must comply with GDPR obligations such as ensuring encryption, access controls, and breach reporting mechanisms.

2. Official Authority

The GDPR uses the term Official Authority particularly in contexts relating to lawful bases for processing and derogations under Articles 6 and 23.

Key Points:

• Refers to the powers vested in public authorities and bodies to carry out tasks in the public interest or in the exercise of official duties.
• It includes law enforcement, regulatory agencies, government departments, and public entities acting under statutory mandates.
• Organizations exercising official authority must ensure that processing is limited to what is necessary and proportionate to the mandate.

Practical Example:

A national traffic authority collecting driver identification details for licensing purposes is exercising official authority under statutory law.

3. Public Interest

Public Interest is a lawful basis for processing under Article 6(1)(e) GDPR:

“Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”

Key Points:

• Includes activities that benefit society at large, such as healthcare, social security, statistical research, environmental protection, and public safety.
• Public interest must be grounded in Union or Member State law.
• The concept balances individual privacy rights with legitimate collective needs.

Practical Example:

Processing health data during a pandemic for contact tracing and vaccination records falls under public interest, as it safeguards community health.

4. Principle of Proportionality

Although not explicitly listed in Article 5 GDPR, the principle of proportionality is embedded in GDPR provisions and in EU Charter of Fundamental Rights.

Key Points:

• Requires that data processing should not exceed what is necessary to achieve the legitimate purpose.
• Processing must be adequate, relevant, and limited to the stated purpose (linked to GDPR's principle of data minimization, Article 5(1)(c)).
• Controllers must demonstrate that the benefits of processing outweigh risks to individual rights.

Practical Example:

If a company requires proof of identity for account verification, asking for a passport number and biometric data would be disproportionate if a simple ID number suffices.

5. Undue Delay

The GDPR refers to “undue delay” in contexts such as:

• Data breach notifications (Article 33(1)): Controllers must notify the supervisory authority “without undue delay and, where feasible, not later than 72 hours after having become aware of it.”
• Data subject rights (e.g., Article 16 - Right to rectification): Personal data must be corrected “without undue delay.”

Key Points:

• “Undue delay” means acting as soon as reasonably possible, considering urgency, risk, and circumstances.
• GDPR often pairs it with specific deadlines (e.g., 72 hours for breaches, 1 month for data subject rights requests).
• Organizations should document decision-making to demonstrate compliance with the requirement.

Practical Example:

If a customer requests correction of their address in a banking system, the bank must update it promptly (within days), not months, as delays could cause financial or regulatory harm.

Conclusion

The GDPR's carefully crafted definitions and principles establish the foundation for lawful and responsible personal data processing.

• Processors must follow strict duties when handling data on behalf of controllers.
• Official Authority and Public Interest enable lawful processing for societal benefit, but within proportional limits.
• The Principle of Proportionality ensures personal data use remains balanced and necessary.
• Undue Delay emphasizes urgency and accountability when protecting data subjects' rights.

Together, these concepts reinforce the GDPR's overarching goal: to safeguard fundamental rights to privacy and data protection while enabling legitimate, necessary, and proportionate processing activities.