European Commission: Proposal for simplification of GDPR record-keeping obligations of organisations with fewer than 750 employees

The European Commission has introduced a new package to simplify rules and reduce bureaucracy across the Single Market. Inter alia, this package aims to simplify record-keeping obligations of Small and Medium-sized Enterprises (SMEs), small mid-caps (SMCs) and organisations with fewer than 750 employees.

According to the Commission’s recent proposal, the GDPR obligation to maintain records of processing activities (RoPA) (Article 30 GDPR) shall not apply to an enterprise or an organisation employing fewer than 750 persons unless the processing it carries out is likely to result in a high risk to the rights and freedoms of data subjects, within the meaning of the provisions on data protection impact assessments (DPIA) (Article 35 GDPR). Currently, organizations which are subject to the GDPR basically have to maintain records of processing activities irrespective of their size or number of employees (the current exemption in Article 30 (5) GDPR for enterprises and organisations employing fewer than 250 persons rarely applies due to its very narrow scope).

While the European Commission intends to drastically reduce bureaucracy, the European Commission clarifies in its Q&As that, to ensure a continued high level of data protection, the proposed changes to the GDPR do not affect any other provisions of the GDPR. It is, therefore, questionable whether the envisaged reduction of bureaucracy would actually take effect. Remaining GDPR requirements, such as on fulfilling accountability requirements (Art. 5 (2) GDPR), finding a legal basis for every processing of personal data (Art. 6 (1) GDPR) or informing data subjects about each processing activity (Art. 13, 14 GDPR), will still require any organisation to have an in-depth knowledge of its own data processing activities.

Our new European Data Legislation Tracker will keep you updated on the legislative proceedings.