LexLint.ioBeta

Know the law your code answers to.

Activities / What code does

Processes personal data

processes_personal_data

Your app collects, stores, uses, or shares information about a person who can be identified, such as a name, an email address, an account, a location, or a device ID.

  • scope code
  • in the registry since 1.11
  • 1,453 laws in 248 jurisdictions name it

What triggers it

The lint's definition. It collects, stores, uses or shares information about an identifiable person: a name, an email address, an account, a location, a device identifier. Accounts, sign-in, analytics or a contact form almost always mean it.

This covers user accounts and sign-in, a contact or sign-up form, analytics that follow visitors, and an order or support history kept for each customer.

What does not

An anonymous total that can no longer be tied to anyone does not count.

Often confused with Processes biometric data, Processes voice recordings and Crawls the web.

The law it brings into scope

The kinds of law that name this activity in the LexLint law library, with the number of laws and jurisdictions in each, as of . The examples are chosen by rule, laws in force first and the widest jurisdiction first; each section's page lists every law.

Area of lawLawsJurisdictions
Privacy law

Have a legal basis for personal data, honor people's rights over it, and report a breach.

 1,326 246
Cybersecurity law

Build software securely, handle reported flaws, and report incidents on a deadline.

 110 73
Product and AI liability law

Answer in damages when defective software or an AI system causes harm.

 24 23

Counterparties that usually come with it

  • a hosting or database provider
  • an analytics or email service

A component that cannot run as documented without one of these names it in its ACTIVITIES.md under talks_to, with required: true. That party's jurisdiction then joins the run of every product that uses the component, and the finding says why it is there. A default the deployer can change is asked about, never added. Talking to a party never makes a product that party.

In a declaration

A library or framework that makes this possible enables it; an application whose shipped code does it performs it.

For a library

activities: - id: processes_personal_data mentioned: enables enabled: requires_configuration where: [<the module that carries it>] note: <one sentence>

For an application

activities: - id: processes_personal_data mentioned: performs enabled: by_default where: [<the module that carries it>] note: <one sentence: what it does, and the kind of law it attracts>

History

In the registry since version 1.11, .

Added for General Data Protection Regulation (GDPR), Comprehensive Regime (European Union), GDPR Articles 12-21, Data Subject Rights (European Union), GDPR Articles 33-34, Breach Notification (European Union), the law that turns on it.

In the glossary: Processes personal data.

The activity registry is LexLint's open list; this page's text is licensed under Creative Commons Attribution 4.0.