Do small companies need a GDPR record of processing activities?

Article 30 of the GDPR requires controllers and processors to keep a record of their processing activities. Article 30(5) exempts organisations with fewer than 250 employees, which leads many small companies to assume they need nothing. The exemption has three exceptions that remove it for most businesses.

When the exemption does not apply

An organisation with fewer than 250 employees must still keep a record if its processing:

• is likely to result in a risk to the rights and freedoms of individuals;
• is not occasional; or
• includes special categories of data (such as health data) or data about criminal convictions and offences.

What that means in practice

Payroll runs every month; a CRM is used every day. Almost every business processes personal data on a regular basis, so the processing is not occasional, and the exemption does not apply to those activities. Supervisory authorities generally read it that way.

What the record contains

For controllers, Article 30(1) lists the contents:

• name and contact details of the controller and, where applicable, the data protection officer;
• the purposes of the processing;
• the categories of data subjects and of personal data;
• the categories of recipients, including recipients in third countries;
• transfers to third countries and the safeguards used;
• where possible, the time limits for erasure;
• where possible, a general description of the security measures.

Why it is worth having anyway

The record is the foundation for everything else: your privacy notice, your answers to access requests, your breach assessment and your answers to customers' due-diligence questionnaires. Our GDPR assessment builds a pre-filled record from your answers, including a processor section if you process data for clients.