This isn't some sort of nefarious "processing": re the GDPR, storage is a form of processing.
So is deletion.
And, as the processor, they are required to do as the controller (you) instructs.
So is deletion.
And, as the processor, they are required to do as the controller (you) instructs.
There seems to be a terminology issue here, "You" would generally be the data subject, not the data controller, unless you are a company.
If you're directly using Office 365 or Google workspace, then MSFT/Google would be the data controller (the primary company who handles the private data), and any subcontractors involved would be data processors on behalf of the controller.
If you're a user in the school system, and have no direct agreement with MSFT/Google, then the school may be the data controller and MSFT/Google handling that data on behalf of the school.
That's not true, which lawyer told you this?
I'm honestly really tired of the FUD surrounding GDPR, it's not actually that complicated.
Check YOUR FUD at the door please.
IE if you send me a file and I put it on a drive and don’t give it to anyone or read it on behalf of anyone but you: it’s fine.
> Processing covers a wide range of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organisation, structuring, _storage_, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.
I feel like you're intentionally missing the second section here.
Regardless, GDPR has hundreds of provisions where it excludes data as long as it's not processed, "storing is processing" in so far as it's secure and not being used by anyone except the account holder isn't going to stand up in any court on the planet, even luddite ones.
> It includes {the [(collection), (recording), (organisation), (structuring), (storage), (adaptation or alteration), (retrieval), (consultation), (use), (disclosure by {[transmission], [dissemination] or [otherwise making available]}), (alignment or combination), (restriction), (erasure) or (destruction)] of personal data}.
So there is no "second section" of the sentence, just a long list. The text of the GDPR has the exact same list [0].