The European Commission wants to help small and medium-sized organisations by easing obligations under the General Data Protection Regulation (GDPR), in order to stimulate economic growth. A recent proposal from the European Commission states that organisations with fewer than 750 employees will soon no longer be required to keep a register of processing activities. This represents an expansion of the existing exemption in article 30(5) GDPR (which, until now, applied to organisations with fewer than 250 employees).
An easing for SMEs? Possibly. But it also raises the question: is it actually wise to simply discard the register of processing activities?
What exactly is the European Commission proposing?
Currently, the GDPR requires organisations to keep an internal register of all processing of personal data. Smaller organisations (fewer than 250 employees) are subject to an exception to this, unless they structurally process sensitive data or the processing involves a high risk.[1]
The European Commission now wants to raise this threshold to 750 employees. However… note that this exemption does not apply where there is high-risk processing within the meaning of article 35 GDPR (think of large-scale monitoring, profiling, or the processing of special categories of personal data). And that is precisely where the problem lies.
Exemption? Yes, but with a caveat
Although the measure sounds like a practical reduction in administrative burden, assessing whether a particular processing activity is “high risk” is in practice often far from straightforward. Especially for small businesses without a privacy officer or legal support, assessing the risk level of a processing activity can be a complicated task. Ironically, making such a risk assessment often already requires the same overview of processing activities — in other words, a register of processing activities.
Moreover, it remains unclear whether a single high-risk processing activity means the entire organisation must still keep a register, or only that specific processing activity. This current uncertainty actually increases the risk of non-compliance.
Why it is nevertheless wise to keep a register of processing activities (regardless of the number of employees)
- Insight into your data processing
Without a register of processing activities, organisations often lack an overview of what data is processed, for what purpose, and on what legal basis. This makes compliance with other GDPR obligations (such as the duty to inform or the principle of data minimisation) difficult. - Supporting risk assessments
A well-maintained register helps assess whether a processing activity poses a high risk, and therefore whether a DPIA (Data Protection Impact Assessment) needs to be carried out. - Trust from customers and partners
Customers, partners and regulators expect organisations to have a grip on their data processing. A register of processing activities contributes to that trust. - Preparedness for supervision or incidents
Should a data breach occur or a complaint be received, a register of processing activities is often the first tool you can use to demonstrate that you take the GDPR (and its obligations) seriously.
Conclusion: formally permitted, but practically unwise
While the European Commission’s proposal may offer some relief for SMEs, it is important to stress that dropping the register of processing activities is not best practice. In many cases, the register remains an essential tool for privacy governance, risk management and compliance — an important means of achieving GDPR maturity!
Being exempt from the obligation does not mean it is no longer a good idea. On the contrary: voluntarily continuing to keep a register of processing activities helps your organisation steer more effectively, limit risks and prevent incidents. The Legal Company advises (almost) every organisation to keep a register of processing activities, regardless of the number of employees.
In short: it may soon no longer be required, but you’re better off keeping it anyway.
👉 Do you need help setting up or updating a register of processing activities? Or do you want to tackle your organisation’s GDPR compliance seriously? Our in-house lawyers are happy to help. Contact us at info@thelegalcompany.nl or call 020 345 0152.
[1] NB: The Legal Company also advises these smaller businesses with fewer than 250 employees to always keep a register of processing activities.
