GDPR, article 4, point (1) states:
‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
GDPR, article 6, point 1. states:
Processing shall be lawful only if and to the extent that at least one of the following applies:
If I develop a pure offline mobile application, do I need to comply with GDPR? Let's say it does ask you for your full name, but only to display your initials. Or something like that.
Alternatively, if I develop a mobile application that does process some personal data on the "backend" (a remote server owned by my company), but some different subset of (potentially more sensitive) personal information is handled purely offline (never leaves the device), do I need to have a lawful basis for processing that data?
I feel that the intention of GDPR is to define "processing" as an action performed by an entity (person, company) either manually or using automated means, when I'm in charge of this data (I can access it, it can be leaked, etc.), so intuitively, offline processing shouldn't be considered "processing" as in GDPR. On the other hand, the definition in Article 4 is so broad that it feels like it does include offline processing.