Now that we have a better understanding of what constitutes personal data, we also need to know what "processing" means. As with personal data, the definition is very broad. The GDPR defines processing to mean any operation or set of operations that is performed on personal data or on sets of personal data, regardless if the processing is done using automatic or manual means. It limits manual operations to those that are made for the purposes of filing. There are very few loopholes.