What counts as large-scale processing under GDPR?
Last updated 5 November 2026. General information only, not legal advice.
GDPR does not define “large scale” or give a fixed number. Whether your processing is large scale depends on factors such as how many people are affected, how much data you hold, how long you keep it and how widely it reaches. It matters because large-scale processing can trigger a requirement to appoint a Data Protection Officer and to carry out a data protection impact assessment.
Why “large scale” matters
The term appears in three places in the GDPR. Article 37(1) requires a DPO where your core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of special-category data or criminal-offence data. Article 35(3) makes a DPIA mandatory for large-scale processing of those same data types and for large-scale systematic monitoring of public areas. For the wider picture, see our guide on whether you need a Data Protection Officer in Ireland.
The factors to weigh
The Article 29 Working Party’s guidelines on DPOs, endorsed by the European Data Protection Board, list factors to consider:
- the number of individuals concerned, as a number or a proportion of the relevant population;
- the volume of data or range of different data items;
- how long the processing lasts or how permanent it is;
- the geographical extent of the processing.
Recital 91 adds that processing of patient data by an individual doctor, other health professional or lawyer is not large scale.
Examples
The guidelines give examples of large-scale processing, including a hospital processing patient data in the ordinary course of its business, an insurance company or bank processing customer data, a telecoms or internet provider processing traffic and location data, and tracking of travellers on public transport. A small practice with a modest patient or client list is generally at the other end of the scale. Many Irish businesses fall in between, so you should record your reasoning rather than guess.
What to do if you are unsure
Document your assessment against each factor and keep it with your records. Consider a DPO or a DPIA as good practice even where it is not clearly required, and review the assessment when your processing grows. Our GDPR guide for small businesses covers the wider obligations.
Need help with this? Plus Promotions Limited provides DPIA support for Irish businesses, from €495. DPIA support.
FAQ
How many people is large scale under GDPR?
There is no set figure. The factors above are weighed together, and the Data Protection Commission and the EDPB have not set a numerical threshold.
Is a small business ever doing large-scale processing?
It can be, for example if it monitors people systematically or handles sensitive data about many individuals. Size of business is not the test; the scale of the processing is.
Does large scale always mean I need a DPO?
No. It must also be part of your core activities and involve regular and systematic monitoring or special-category or criminal-offence data.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
