Spanish Supreme Court Rules GDPR Data Processing Begins at Point of Data Request, Not Receipt

The Supreme Court of Spain ruled that 'data processing' under Article 4(2) of the GDPR occurs when a data subject makes a request for their data, even if the data is never actually provided. Identified as Supreme Court Ruling 1590/2026, the decision significantly expands the scope of GDPR obligations for organizations handling data subject requests, with direct implications for data minimization principles and compliance workflows. The ruling could affect U.S. companies processing EU data subjects' information and has relevance for CCPA and U.S. state privacy law compliance.