Flag

28 May Proposed changes to EU requirements to hold records of processing activity

Posted at 13:17h in home by

On 21 May 2025, the European Commission released a proposal to amend the General Data Protection Regulation (GDPR) in order to extend and simplify specific articles, in particular to address the sudden compliance obligation which appears when an organisation outgrows the usual Small Medium-cap Enterprise (“SME”) definition.

Currently, Article 30 requires data processors and controllers to keep a detailed record of their data processing activities. Drawing up these records can be a complicated and time-consuming exercise. However, an exemption may apply, which relieves a business of these record keeping duties, if it has fewer than 250 employees.

However the exemption is NOT available if:

  • the data being processed presents a risk to the rights and/or freedoms of any individual (i.e. their rights under the GDPR); or
  • the processing happens more than occasionally; or
  • the data includes special category data (such as data relating to health, racial/ethnic origin, religious/philosophical beliefs, sex life or sexual orientation, genetic or biometric data) or data which relates to criminal convictions and offences.

(Note that an organisation only has to hit one of these criteria, not all three, to be ineligible for the exemption.)
The Commission’s proposal seeks to expand the circumstances in which the exemption will be available. Firstly, the threshold for the exemption will be extended to (newly defined) Small Medium-cap Companies (“SMCs”), with fewer than 750 employees and operating below certain financial thresholds.

Furthermore, the carve-outs from the exemption are to be reduced in a number of ways. Firstly, the ‘more than occasional processing’ carve-out will be removed entirely, so that an SMC will benefit from the exemption even if its processing of personal data is more than ‘occasional’ (which is very often the case).

Secondly, the exemption will still be available if the business is processing special category data, provided that it is done for the purposes of performing obligations or exercising rights in the field of employment, social security and social protection law. This is important, because many businesses will process special category data purely for the purposes of employing staff, and the proposal will mean that they will not thereby be required to keep records of processing activity.
Thirdly, the threshold for the exemption being removed where data processing poses a risk to the rights and freedoms of individuals, will be raised to one of ‘high risk’. This will mean that the exemption from keeping records of processing activity will be available in more cases.

 

What does this mean for business in the UK?

It remains to be seen whether the UK government will seek to amend UK GDPR to follow EU reform. However, the UK government has clearly stated its desire to introduce greater flexibility into data protection laws in order to promote economic growth, and this proposal is one way in which the European Commission is seeking to do this within the EU. Its announcement of these proposed measures states that it is “working to reduce unnecessary bureaucracy and create a regulatory environment that drives innovation, growth, quality jobs and investment” and that by 2029, it aims to streamline rules and reduce the administrative burdens for businesses by 25%, and for SMEs by 35%.

Providing that these changes come into effect, businesses that fall under the definition of a SMC will be able to access the same benefits as currently afforded to SMEs under Article 30 of the GDPR. This will promote growth and competitiveness by removing the compliance obligations currently imposed.

Ultimately, there is a possibility that the UK could follow suit whilst maintaining its ‘adequacy’ status with regards to international data transfers. Therefore, these changes could be on the horizon in the UK as well as in the EU.

If you require assistance on how these changes may affect your business, or support with drawing up your records of processing activity, please do not hesitate get in touch with our expert team.