Data processing is when any action is performed on a piece of data, automated or otherwise. Data processing includes collecting, compiling, storing, organizing, or sharing data. Under GDPR, a company can process the personal data of its users if it has one of six legal bases for processing, such as consent, contract, legal obligation, legitimate interest, vital interests, public task, or legitimate interests for marketing purposes.