any action (operation) or set of actions (operations) performed on personal data, with or without the use of automation