# EDPB- EDPS Joint Opinion 01/2025 on the Proposal for a Regulation on simplification measures for SMEs and SMCs, in particular the record-keeping obligation under Art. 30(5) GDPR

- Type: Guidance
- Source: EDPB
- Identifier: edpb-edps-jointopinion-202501-proposalsimplification-en
- Date: 2025-07-09
- Original: https://www.edpb.europa.eu/documents/legislative-opinion/edpb-edps-joint-opinion-012025-on-the-proposal-for-a-regulation-on_en
- Canonical: https://overview.legal/posts/50980
- Topics: Processing, Accountability, Privacy Impact Assessment, Right of Access Procedures, Certification, Controllers, DPIA, Security, Right of Access, Public Authority

## Summary

De EDPB en EDPS steunen het doel om de administratieve lasten voor SMCs en MKB te verminderen, mits dit de bescherming van fundamentele rechten niet verlaagt. Ze benadrukken de noodzaak van een evenwichtige en proportionele aanpak en vragen om verduidelijking van de nieuwe drempel van 750 werknem...

## Full text

Adopted 1 EDPB-EDPS Joint Opinion 01/2025 on the Proposal for a Regulation on simplification measures for SMEs and SMCs, in particular the record-keeping obligation under Art. 30(5) GDPR Adopted on 8 July 2025 Adopted 2 CONTENTS 1 BACKGROUND ................................................................................................................................ 4 2 GENERAL REMARKS ........................................................................................................................ 6 3 THE DEROGATION FROM THE REQUIREMENT TO MAINTAIN A RECORD OF PROCESSING ACTIVITIES UNDER ARTICLE 30(5) GDPR (ARTICLE 1(2) OF THE PROPOSAL) .......................................... 7 3.1. On ‘likely to result in a high-risk’ ............................................................................................. 7 3.2. On the record keeping obligation under Article 30 GDPR ....................................................... 8 3.3 On the revised threshold, and on the reference to SMEs and SMCs and organisations in the text of the Proposal ........................................................................................................................... 10 3.3.1 “Employing fewer than 750 persons” ................................................................................. 11 3.3.2 “Enterprises” ....................................................................................................................... 11 3.3.3 “Organisations” .................................................................................................................. 12 4 THE EXTENSION OF ARTICLES 40(1) AND 42(1) GDPR TO SMC (ARTICLE 1(3) AND (4) OF THE PROPOSAL). ........................................................................................................................................... 12 Adopted 3 Executive summary On 21 May 2025, the European Commission issued a Proposal for a Regulation amending certain regulations, including the GDPR, as regards the extension of certain mitigating measures available for small and medium sized enterprises (‘SMEs’) to small mid-cap enterprises (‘SMCs’) and further simplification measures (‘the Proposal’). The Commission formally consulted the EDPB and the EDPS in accordance with Article 42(2) of Regulation (EU) 2018/1725. The Proposal would modify the derogation under Article 30(5) GDPR by providing that the record- keeping obligation would not apply to an enterprise or organisation employing fewer than 750 persons unless the processing it carries out is likely to result in a high risk to data subjects’ rights and freedoms, within the meaning of Article 35 GDPR. In addition, the Proposal would introduce a definition of SMEs and SMCs in Article 4 GDPR and extend the scope of Article 40(1) and 42(1) GDPR to the SMCs. The EDPB and the EDPS support the general objective of the Proposal to reduce the administrative burden for SMEs and SMCs as long as pursuing this objective does not result in lowering the protection of fundamental rights of individuals, in particular the fundamental right to protection of personal data. The EDPB and the EDPS welcome, in this regard, that the proposed modifications to the GDPR to simplify and clarify the obligation to keep a record of processing are targeted and limited in nature and do not affect the core principles and other obligations under the GDPR. At the same time, the EDPB and the EDPS recall the importance of the fundamental right to protection of personal data and the need to ensure that, in light of Article 52 of the Charter, simplification is proportionate, balanced and based on necessity. In this regard, the EDPB and the EDPS note that the Proposal does not include an assessment of the consequences on fundamental rights of the proposed changes to the GDPR, which should have been conducted. The EDPB and the EDPS welcome the clarification and simplification efforts concerning the conditions in which the derogation under Article 30(5) GDPR would apply by providing that this derogation would not apply to processing ‘likely to result in a high risk'. To avoid any misunderstanding, the EDPB and the EDPS propose to the co-legislators to clarify in the recitals that a record of processing would only be mandatory for those processing activities ‘likely to result in a high risk'. The EDPB and the EDPS highlight that the processing of personal data covered under Articles 9 and 10 GDPR is important to assess whether the processing is likely to result in a high risk. In this regard, the EDPB and the EDPS suggest that the co-legislators rephrase Recital 10 compared to the Proposal in order to clarify that processing for the purposes envisaged under Article 9(2)(b) GDPR would not require that a record of processing be maintained, unless an assessment indicates that the processing is likely to result in a high risk. Regarding the record keeping obligation under Article 30 GDPR, the EDPB and the EDPS highlight that, in addition to facilitating ex-post compliance demonstration, records of processing activities constitute a very useful means to support compliance with several GDPR requirements. The EDPB and the EDPS therefore encourage enterprises and organisations employing fewer than 750 persons that do not engage in high-risk processing to choose the most appropriate methods to adequately support compliance with GDPR obligations and not have a negative impact on data subjects’ rights. Furthermore, the EDPB and the EDPS would welcome further clarifications on why the new threshold of enterprises or organisations employing fewer than 750 persons would be appropriate for the specific case of the GDPR. Concerning the references to SMEs and SMCs and organisations in the text Adopted 4 of the Proposal, the EDPB and the EDPS recommend the co-legislators to make reference in the amended Article 30(5) GDPR to the newly introduced definitions of SMEs and SMCs. In addition, they recommend the co-legislators to clarify in a recital that the term ‘organisation’ falling within the proposed derogation under Article 30(5) GDPR does not include public authorities and bodies. The European Data Protection Board and the European Data Protection Supervisor Having regard to Article 42(2) of the Regulation 2018/1725 of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, Having regard to the EEA Agreement and in particular to Annex XI and Protocol 37 thereof, as amended by the Decision of the EEA joint Committee No 154/2018 of 6 July 2018, HAVE ADOPTED THE FOLLOWING JOINT OPINION 1 BACKGROUND 1. On 21 May 2025, the European Commission (‘the Commission’) issued a Proposal for a Regulation of the European Parliament and of the Council amending Regulations (EU) 2016/679 (‘GDPR’) 1 , (EU) 2016/1036, (EU) 2016/1037, (EU) 2017/1129, (EU) 2023/1542 and (EU) 2024/573 as regards the extension of certain mitigating measures available for small and medium sized enterprises (‘SMEs’) to small mid-cap enterprises (‘SMCs’) and further simplification measures (‘the Proposal’). On the same date, the Commission formally consulted the EDPB and the EDPS in accordance with Article 42(2) of Regulation (EU) 2018/1725 2 (‘EUDPR’) 3 . The EDPB and the EDPS limit their Opinion to the proposed amendments to the GDPR. 2. The objective of the Proposal is to address in a coherent manner the situation where SMCs outgrow the segment of SMEs and become faced with rules that apply to large enterprises. The Proposal aims to make business easier for SMCs and reduce their administrative burden by amending a number of existing acts - including the GDPR - which provide for specific mitigating rules for SMEs extending the scope of those provisions and include SMCs 4 . 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ L 119, 4.5.2016, pages 1–88. 2 Regulation (EU) 2018/1725 of the European Parliament and of the Council of 23 October 2018 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies and on the free movement of such data, and repealing Regulation (EC) No 45/2001 and Decision No 1247/2002/EC, OJ L 295, 21.11.2018, pages 39–98. 3 On 23 May 2025, the Commission sent a corrigendum to the Proposal, COM(2025) 502/2. 4 Recital 5 of the Proposal. Adopted 5 3. To this end, the Proposal would introduce the following changes to the GDPR: • Introducing a definition of SMEs and SMCs into Article 4 GDPR. It is proposed to provide that SMEs means enterprises as defined in Article 2 of the Annex to Commission Recommendation 2003/361/EC’ 5 . The EDPB and the EDPS note that this follows the approach of current recital 13 GDPR. It is also proposed to provide that SMCs means enterprises as defined in point (2) of the Annex to Commission Recommendation of 21 May 2025 on the definition of small mid-cap enterprises - C(2025) 3500 final 6 . The Commission Recommendation provides that SMCs are enterprises which are not SMEs in accordance with Recommendation 2003/361/EC, employ fewer than 750 persons, and have an annual turnover not exceeding EUR 150 million or an annual balance sheet total not exceeding EUR 129 million; • Broadening the scope of the derogation to the obligation to maintain a record of processing activities under Article 30(5) GDPR to include enterprises or organisations employing fewer than 750 persons . This derogation currently applies to enterprises and organisations with fewer than 250 employees, provided that the processing is not likely to pose a risk to the rights and freedoms of data subjects, is not occasional, and does not involve special categories of data (Article 9(1) GDPR) or personal data relating to criminal convictions and offences (Article 10 GDPR). Under the Proposal, the current record-keeping obligation for such enterprises and organisations would remain mandatory when the processing is ‘likely to result in a high risk to the rights and freedoms of data subjects’ 7 ; • Extending the scope of Article 40(1) and 42(1) GDPR to SMCs, so that their specific needs are also considered when codes of conduct are drawn up and in the context of certification mechanisms 8 . 4. On 6 May 2025, before the adoption of the Proposal, the Commission sent a letter to the EDPB and the EDPS requesting their feedback concerning its upcoming draft proposal on the simplification of record-keeping obligations under the GDPR. In their joint reply dated 8 May 2025 9 , the EDPB and the EDPS, based on the information available at that time 10 and pending a full analysis of the specific proposal, expressed preliminary support to this targeted simplification initiative, bearing in mind that this would not affect the obligation of controllers and processors to comply with other GDPR obligations. Nevertheless, the EDPB and the EDPS asked for more information from the Commission to better evaluate the impact on the organisations subject to this change, to assess whether the proposal ensures a proportionate and fair balance between the protection of personal data and the interests of SMCs. 5 Article 1(1) of the Proposal. 6 Article 1(1) of the Proposal. 7 Article 1(2) of the Proposal. 8 Article 1(3) and (4) of the Proposal. 9 EDPB-EDPS Letter on European Commission draft proposal on simplification of record-keeping under the GDPR, 8 May 2025. 10 In particular, the EDPB and the EDPS note that, while the Commission stated in its letter that the threshold for the size of organisations eligible for the new record-keeping derogation would be 500 employees, this figure has been increased in the Proposal to include enterprises and organisations with fewer than 750 employees. Adopted 6 2 GENERAL REMARKS 5. The EDPB and the EDPS support the general objective of the Proposal to reduce the administrative burden for SMEs and SMCs as long as pursuing this objective does not result in lowering the protection of fundamental rights of individuals, in particular the fundamental right to protection of personal data 11 . The EDPB and the EDPS welcome, in this regard, that the proposed modifications to the GDPR to simplify and clarify the obligation to keep a record of processing are targeted and limited in nature and do not affect the core principles and other obligations under the GDPR. 6. The EDPB and the EDPS recall the importance of the fundamental right to protection of personal data and the need to ensure that, in light of Article 52 of the Charter, simplification is proportionate, balanced and based on necessity. 7. In this regard, the EDPB and the EDPS note that the Proposal does not include an assessment of the consequences on fundamental rights of enlarging the scope of the derogation to the obligation to maintain a record of processing, and in particular on the right to protection of personal data of the individual. Even if such an assessment may not be relevant for certain pieces of legislation subject to the Omnibus Proposal, and notwithstanding the EDPB and EDPS’ own assessment that the core principles and other obligations under the GDPR remain unaffected, such an assessment should still have been conducted in relation to the modifications proposed to the GDPR 12 . This is particularly important considering that the GDPR protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data 13 . 8. The EDPB and the EDPS note that, in line with the EDPB 2024-2027 Strategy 14 , the EDPB is working on measures to facilitate compliance for SMEs and that several dedicated practical resources have already been released under this initiative 15 . Several initiatives have also been developed by supervisory authorities (‘SAs’) to facilitate compliance of SMEs with Article 30 GDPR, for instance through the provision of templates for (simplified) records for processing activities to assist SMEs in documenting their processing activities 16 . The EDPB and EDPS recognise the importance of the EDPB and SAs’ continued work in this regard and of their roles in continuing to guide smaller controllers and processors. 11 Article 8(1) of the Charter of Fundamental Rights of the European Union (the ‘Charter’) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU). 12 For example, such an assessment would have been important in relation to the removal of the condition relating to the processing of personal data covered by Article 9 or Article 10 GDPR, which under the current text of Article 30(5) GDPR triggers the duty to keep records of processing activities for enterprises and organisations falling within the 250-employee threshold. 13 See Article 1(2) GDPR. 14 EDPB 2024-2027 Strategy, Pillar 1, Key Action 3. 15 EDPB Data Protection Guide for small business, Practical resources for SMEs, Available at: https://www.edpb.europa.eu/sme-data-protection-guide/practical-resources-for-smes_en . The EDPB also develops summary of its guidelines. 16 Communication from the Commission to the European Parliament and the Council Data protection as a pillar of citizens’ empowerment and the EU’s approach to the digital transition - two years of application of the General Data Protection Regulation, COM(2020) 264 final, 24.6.2020, Section 2, page 9 ; Second Report on the application of the General Data Protection Regulation, COM(2024) 357 final, 25.7.2024, Section 5.2. Adopted 7 3 THE DEROGATION FROM THE REQUIREMEN T TO MAINTA IN A RECORD OF PROCESSING ACTIVITIES UNDER ARTICLE 30(5) GDPR (ARTICLE 1(2) OF THE PROPOSAL) 3.1. On ‘likely to result in a high-risk’ 9. The EDPB and the EDPS welcome the clarification and simplification efforts concerning the conditions in which the derogation under Article 30(5) GDPR would apply. The EDPB and the EDPS are aware that Article 30(5) GDPR, in its current form, may not always have achieved its objective, for example because the exception would typically not be applicable for very small enterprises or organisations with either one or only a few employee(s) as soon as the processing would not be of an occasional nature. 10. At the same time, as highlighted in the joint EDPB-EDPS reply of 8 May 2025 , the Proposal would keep the obligation to maintain a record of processing when processing is likely to result in a high risk to the rights and freedoms of data subjects. This is in line with the risk-based approach underlying the GDPR, as even very small companies may carry out processing that is likely to result in a high-risk 17 . 11. The EDPB and the EDPS highlight that, in order to determine whether a processing is 'likely to result in a high risk', which impacts whether they can benefit from the derogation, controllers will still have to perform an assessment of the risk posed by their processing 18 . 12. The EDPB and the EDPS propose to the co-legislators to clarify in the recitals that a record of processing would only be mandatory for those processing activities ‘likely to result in a high risk'. This would avoid the text being misunderstood as meaning that a record of all processing activities is mandatory from the moment at least one of these processing activities is likely to result in a high risk 19 . 13. The condition ‘likely to result in a high risk to the rights and freedoms of data subjects’ under the proposed amendment to Article 30(5) GDPR is the same condition for carrying out an impact assessment pursuant to Article 35 GDPR. In practice, the two provisions read together would mean that when processing is likely to result in a high risk, an impact assessment should be conducted, and a record of processing should be maintained. 14. As already noted in the joint EDPB-EDPS letter of 8 May 2025 , the EDPB has provided guidance on the notion of ‘processing likely to result in a high risk’ 20 . In addition, examples may be found in the national lists of types of processing that are subject, or are not subject, to the requirement of a data protection 17 EDPB-EDPS Letter on European Commission draft proposal on simplification of record-keeping under the GDPR, 8 May 2025, page 2. 18 Article 29 Working Party Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679, (wp248, rev.01), endorsed by the EDPB on 25 May 2018 (hereafter “DPIA Guidelines”), page 12. 19 Article 29 Working Party, Position Paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR, endorsed by EDPB on 25 May 2018 (hereafter, “WP29 Position Paper on Article 30(5) GDPR”), p. 2 (“such organisations need only maintain records of processing activities for the types of processing mentioned by Article 30(5)”). 20 See, in this regard, DPIA Guidelines, pages 8-13. Adopted 8 impact assessment 21 . The EDPB stands ready to support SAs in ensuring consistent application of the notion of ‘processing operations likely to result (or not) in a high risk’ where necessary. 15. Under the current version of Article 30(5) GDPR, processing of personal data covered by Article 9 or 10 GDPR is enough to trigger the duty to keep records of processing activities for enterprises and organisations with fewer than 250 employees. Under the Proposal, this condition is deleted from the text of Article 30(5) GDPR. The EDPB and EDPS note the significance of this simplification given the special protection afforded by the GDPR to these categories of data. The removal of the conditions relating to processing that is not occasional and processing of personal data governed by Articles 9(1) or 10 GDPR may, in practice, be even more impactful than the raising of the threshold relating to the number of employees. The use of personal data covered by Article 9(1) or 10 GDPR will need to be considered when assessing the risk posed by a processing activity 22 . The EDPB and EDPS recall that the processing of such personal data is one of the factors that may lead to the likelihood of a high risk 23 . 16. In this regard, Recital 10 of the Proposal provides that ‘the processing of special categories of personal data under Article 9(2)(b) GDPR for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law should not as such require that records of processing be maintained’. The EDPB and the EDPS agree that some processing activities foreseen under Article 9(2)(b) GDPR, governed by Union or Member State law that has provided for effective safeguards, may not be likely to result in a high risk. At the same time, the EDPB and the EDPS underline that some other processing foreseen by Article 9(2)(b) GDPR may still be likely to result in a high risk, e.g. systematic monitoring of employees in the workplace involving the processing of special categories of data 24 . 17. The proposed recital cannot derogate from the requirements that would result from the enacting terms of the Proposal, according to which a record of processing would be required when the processing is likely to result in a high risk. Therefore, the EDPB and the EDPS suggest that the co- legislators explicitly clarify in the recital that processing for the purposes envisaged by Article 9(2)(b) GDPR would in principle not likely result in a high risk to data subjects - and therefore not require as such that a record of processing be maintained - unless an assessment indicates that the processing is likely to result in a high risk. This would ensure that, for application of the derogation under Article 30(5) GDPR, the same condition is applied to all processing, and that it would be consistent with the one applicable under Article 35 GDPR. 3.2. On the record keeping obligation under Article 30 GDPR 18. The EDPB and the EDPS recall that, by replacing the prior notification regime previously applicable under the Directive 95/46/EC 25 with an instrument such as the record of processing activities, the 21 Adopted under Article 35(4) GDPR and Article 35(5) GDPR. Available on the EDPB website, within the Register of decisions taken by SAs on issues handled in the consistency mechanism. 22 See Article 35(3)(b) GDPR. 23 The EDPB and the EDPS note that recital 9 of the Proposal refers to Article 35(3) GDPR, which provides that a DPIA shall be in particular required in case of processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10. In such case, processing may be likely to result in a high risk. See also DPIA Guidelines, page 11. 24 Without prejudice to national law prohibiting such processing. See also, DPIA Guidelines, page 11. 25 Article 18 of Directive 95/46/EC. Adopted 9 GDPR placed the responsibility on controllers 26 and processors 27 to document relevant information on processing activities in a single location and to make it available to competent authorities upon request 28 . In this context, the record of processing activities serves as a means for controllers and processors to demonstrate compliance in line with the accountability principle 29 and for competent authorities to monitor processing 30 . However, as the EDPB has pointed out on several occasions, in addition to facilitating ex-post compliance demonstration, records of processing activities constitute a very useful means to support an analysis of the implications of any processing whether existing or planned 31 . 19. In practical terms, the usefulness of this tool is clear in several contexts, such as among others: • Records help controllers to have a comprehensive overview of all processing activities, thereby aiding controllers among others to comply with the principles listed by Article 5 GDPR and to identify a lawful basis under Article 6 GDPR; • Records help controllers to give effect to data subject rights, such as for the development of privacy policies or in the context of the exercise of the right of access to personal data under Article 15 GDPR 32 . They also ‘[facilitate] the factual assessment of the risk of the processing activities performed by a controller or processor on individuals’ rights’ 33 ; • Records are an important source of information for controllers in the context of assessing the risks, and of deciding whether or not to carry out a DPIA pursuant to Article 35 GDPR 34 ; • Records are among the tools which enable DPOs to perform their tasks, including monitoring compliance, informing and advising the controller or the processor 35 ; • Records of processing activities are helpful to determine the main establishment of a controller 36 , thereby the lead SA competent for specific cross-border processing activities 37 ; 26 Article 30(1) GDPR. 27 Article 30(2) GDPR. 28 Article 30(4) GDPR. 29 See, in particular, Article 5(2) and 24 GDPR for controllers and Article 28 GDPR for processors. On the notion of accountability. See also EDPB Guidelines 7/2020 on the concept of controller and processor in the GDPR, adopted on 7 July 2021, para. 6-10. 30 This objective is supported by Recital 82 GDPR, according to which: ‘In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations’. 31 WP29 Position Paper on Article 30(5) GDPR, page 2. 32 EDPB Guidelines 01/2022 on data subject rights - Right of access, version 2.1., adopted on 28 March 2023, para. 20 and 112. 33 WP29 Position Paper on Article 30(5) GDPR, page 2. 34 DPIA Guidelines, page 12. 35 Article 29 Working Party, Guidelines on Data Protection Officers (‘DPOs’), endorsed by the EDPB on 25 May 2018 (hereafter “DPO Guidelines”), section 4.5. 36 EDPB Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR, adopted on 13 February 2024, para. 32. 37 This also allow the Controller to demonstrate its claim. EDPB Guidelines 8/2022 on identifying a controller or processor’s lead supervisory authority, version 2.1, adopted on 28 March 2023, para. 37. Adopted 10 • In the context of transfers of personal data to third countries, records of processing activities can help controllers and processors in the evaluation of whether measures to supplement transfer tools would be appropriate 38 ; • Records help controllers and processors to map and understand their processing activities when deploying new technologies such as AI, helping them to use innovative and novel processing activities while respecting the right to the protection of personal data 39 . • Processors may be asked by controllers to share parts of their records of processing activities so that the controller is fully informed as to the details of the processing that are relevant to demonstrate compliance with Article 28 GDPR 40 and can verify the guarantees provided by processors 41 ; • Records facilitate ‘the identification and implementation of appropriate security measures to safeguard personal data’ 42 ; • The controller may also choose to document breaches under Article 33(5) GDPR as part of its record of processing activities which is maintained pursuant to Article 30 GDPR 43 . 20. The proposed change would no longer prescribe a record of processing in accordance with Article 30 GDPR for enterprises and organisations employing fewer than 750 persons, and which do not engage in processing likely to result in a high risk. 21. In these cases falling within the derogation, Article 30(1) and (2) GDPR would not apply, meaning there could not be a violation of this provision and this could not lead to a sanction. However, the EDPB and the EDPS underline that controllers and processors falling within the derogation would still be subject to all the other requirements under the GDPR, for which, as explained above, record keeping may help to achieve compliance. 22. These controllers and processors may then choose the most appropriate methods to ensure and demonstrate compliance, in line with the principle of accountability, benefiting from greater flexibility in how they organise themselves. The EDPB and the EDPS would like to underline that enterprises and organisations need to ensure that such method adequately supports compliance with the GDPR and does not have a negative impact on the data subjects’ rights. 3.3 On the revised threshold, and on the reference to SMEs and SMCs and organisations in the text of the Proposal 38 EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, version 2.0, adopted on 18 June 2021, para. 9. 39 See, for example, the fact that records of processing activities can help controllers to implement the various safeguards discussed in Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models. 40 EDPB Guidelines 07/2020 on the concepts of controller and processor in the GDPR, version 2.1, adopted on 7 July 2021, para. 93 and 143. 41 EDPB Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s), adopted on 7 October 2024, para. 41 and footnote 38. 42 WP29 Position Paper on Article 30(5) GDPR, page 2. 43 EDPB Guidelines 9/2022 on personal data breach notification under GDPR, version 2.0, adopted on 28 March 2023, footnote 47. Adopted 11 3.3.1 “Employing fewer than 750 persons” 23. The EDPB and the EDPS understand that the purpose of a general SMCs definition, which corresponds to three times the size of SMEs, is to provide support for these companies which are dealing with similar challenges to those of SMEs 44 . In this context, the Proposal introduces the notion of SMCs in a number of legal acts - including the GDPR - where mitigating or supporting measures were already available for SMEs. 24. The EDPS and the EDPB welcome the assessment provided by the legislative financial and digital statement accompanying the Proposal, already requested in their joint reply. The EDPB and the EDPS note that the new threshold of 750 employees will allow 38,000 SMCs – in addition to the 26 million SMEs 45 – to potentially enter into the scope of the new derogation under Article 1(2) of the Proposal 46 . This revised threshold may entail that, in some Member States, very few controllers and processors would reach this threshold. Hence, a small number of controllers and processors would remain subject to the record-keeping obligation based solely on their size. 25. Against this background, the EDPB and the EDPS would welcome further clarifications on why the new threshold of enterprises or organisations employing fewer than 750 persons would be appropriate for the specific case of the GDPR 47 , and in particular why the threshold of 500 employees initially considered by the Commission when informally consulting the EDPB and the EDPS was estimated to be too low. 3.3.2 “Enterprises” 26. T he EDPB and the EDPS note that the proposed amendment to Article 30(5) GDPR does not refer to the notions of SMEs and SMCs, but rather to ‘an enterprise […] employing fewer than 750 persons’ 48 . As a result, in practice, the amendment to Article 30(5) GDPR would also apply to enterprises employing fewer than 750 employees, but which do not qualify as SMEs or SMCs due to their higher annual turnover or balance sheet total. This appears to be in contradiction with Recital 9 of the Proposal, which refers to the amendment as ‘extending the scope of the derogation from the record- keeping obligation to SMCs and organisations with fewer than 750 employees’. 27. The notions of SMEs and SMCs are referred to in the proposed amendments to Article 40 and Article 42 GDPR regarding codes of conduct and certification. 28. The EDPB and the EDPS recommend to the co-legislators - in case they consider it appropriate to use the threshold of 750 employees (as discussed in Section 3.3.1) - to make reference in the amended Article 30(5) GDPR to the newly introduced definitions of SME and SMC to replace the notion of 44 Explanatory memorandum of the Proposal, page 3. 45 Commission Staff Working Document accompanying the Proposal, page 8. 46 Legislative financial and digital statement accompanying the Proposal, page 4: “The proposal/initiative is targeted at the approximately 38,000 small mid-caps in the EU, which are defined as enterprises with between 250 and 749 staff (for the estimation here: relying on head-count only)”. See also Commission Staff Working Document accompanying the Proposal, page 8. 47 Considering that the same threshold is proposed for other pieces of legislation as well such as legislation on the protection against dumped or subsidised imports, financial instruments, or greenhouse gases. 48 Whereas the Explanatory Memorandum states “ At the same time, the scope of the derogation should be broadened to include SMCs and organisations with fewer than 750 employees ” (pages 4 and 8). Adopted 12 ‘enterprise’ . This would better pursue the objectives of the Proposal and ensure consistency with the reference to these definition in Article 40 and 42 regarding codes of conduct and certification. 3.3.3 “Organisations” 29. In line with current Article 30(5) GDPR, the EDPB and the EDPS understand that the exception to maintain a record of processing in accordance with the conditions set out under the provision would apply not only to enterprises, but also to other ‘organisations’ (e.g. non-profit and charities). 30. The EDPB and the EDPS note that the Explanatory Memorandum states that “ The current proposal intends to mirror the SMCs situation to the one of SMEs in a number of legal acts, covering different policy areas. It aims at making the achievement of the objectives of those legislations more efficient and less burdensome for enterprises, organisations and public authorities [emphasis added]” 49 . 31. The EDPB and the EDPS note that Article 30(5) GDPR refers to both enterprises and organisations and does not refer to ‘public authorities and bodies’ 50 . 32. Since the Proposal not only aims for simplification and clarification, but also for competitiveness and productivity, a derogation for public authorities and bodies would not be necessary for, and therefore would not meet, the objectives of the Proposal. Moreover, exempting public authorities and bodies from the obligation to keep a record of processing would likely result in a large number of public authorities and bodies that are not subject to this obligation. This appears inconsistent with the special role that the GDPR attaches to public authorities and bodies’ accountability, as highlighted by their obligation under Article 37 GDPR to designate a data protection officer in any case 51 . 33. Therefore, to avoid any possible confusion as to whether public authorities and bodies would fall within the scope of the derogation, the EDPB and the EDPS recommend the co-legislators to clarify in a recital that the term ‘organisation’ does not include public authorities and bodies. 4 TH E EXTENSION OF ARTICLES 40(1) AND 42(1) GDPR TO SMC (ARTICLE 1(3) AND (4) OF THE PROPOSAL). 34. Article 1(3) and (4) of the Proposal amend the scope of Articles 40(1) and 42(1) GDPR to include SMCs. Recital 11 of the Proposal specifies that this addition aims to take into account the specific needs of SMCs when codes of conduct are drawn up and in the context of certification mechanisms. The EDPB and the EDPS welcome this addition, which they note is already in line with the EDPB’s 2024–2027 Strategy to continue supporting compliance measures such as certification and codes of conduct, including through engagement with key stakeholder groups 52 . 49 Explanatory memorandum of the Proposal, page 6. 50 The GDPR refers, for instance, to “public authorities or bodies” in Article 37(1)(a) GDPR. 51 See Article 37(1)(a) GDPR and DPO Guidelines, page 4. 52 EDPB Strategy 2024-2027, 18 April 2024, Pillar 1, available at: https://www.edpb.europa.eu/system/files /2024-04/edpb_strategy_2024-2027_en.pdf . Adopted 13 For the European Data Protection Supervisor The European Data Protection Supervisor (Wojciech Wiewiorowski) For the European Data Protection Board The Chair (Anu Talus)

## Cited law provisions (39)

### GDPR — gdpr-art-1-par-1-nl

Bij deze verordening worden regels vastgesteld betreffende de bescherming van natuurlijke personen in verband met de verwerking van persoonsgegevens en betreffende het vrije verkeer van persoonsgegevens.

### GDPR — gdpr-art-1-par-2-nl

Deze verordening beschermt de grondrechten en de fundamentele vrijheden van natuurlijke personen en met name hun recht op bescherming van persoonsgegevens.

### GDPR — gdpr-art-1-par-3-nl

Het vrije verkeer van persoonsgegevens in de Unie wordt noch beperkt noch verboden om redenen die verband houden met de bescherming van natuurlijke personen ten aanzien van de verwerking van persoonsgegevens.

### GDPR — gdpr-art-5-par-2-nl

De verwerkingsverantwoordelijke is verantwoordelijk voor de naleving van lid 1 en kan deze aantonen („verantwoordingsplicht”).

### GDPR — gdpr-art-8-par-1-nl

Wanneer artikel 6, lid 1, punt a), van toepassing is in verband met een rechtstreeks aanbod van diensten van de informatiemaatschappij aan een kind, is de verwerking van persoonsgegevens van een kind rechtmatig wanneer het kind ten minste 16 jaar is. Wanneer het kind jonger is dan 16 jaar is zulke verwerking slechts rechtmatig indien en voor zover de toestemming of machtiging tot toestemming in dit verband wordt verleend door de persoon die de ouderlijke verantwoordelijkheid voor het kind draagt.

### GDPR — gdpr-art-9-par-1-nl

Verwerking van persoonsgegevens waaruit ras of etnische afkomst, politieke opvattingen, religieuze of levensbeschouwelijke overtuigingen, of het lidmaatschap van een vakbond blijken, en verwerking van genetische gegevens, biometrische gegevens met het oog op de unieke identificatie van een persoon, of gegevens over gezondheid, of gegevens met betrekking tot iemands seksueel gedrag of seksuele gerichtheid zijn verboden.

### GDPR — gdpr-art-9-par-2-nl

Lid 1 is niet van toepassing wanneer aan een van de onderstaande voorwaarden is voldaan:

### GDPR — gdpr-art-30-par-1-nl

Elke verwerkingsverantwoordelijke en, in voorkomend geval, de vertegenwoordiger van de verwerkingsverantwoordelijke houdt een register van de verwerkingsactiviteiten die onder hun verantwoordelijkheid plaatsvinden. Dat register bevat alle volgende gegevens:

### GDPR — gdpr-art-30-par-2-nl

De verwerker, en, in voorkomend geval, de vertegenwoordiger van de verwerker houdt een register van alle categorieën van verwerkingsactiviteiten die zij ten behoeve van een verwerkingsverantwoordelijke hebben verricht. Dit register bevat de volgende gegevens:

### GDPR — gdpr-art-30-par-4-nl

Desgevraagd stellen de verwerkingsverantwoordelijke of de verwerker en, in voorkomend geval, de vertegenwoordiger van de verwerkingsverantwoordelijke of de verwerker het register ter beschikking van de toezichthoudende autoriteit.

### GDPR — gdpr-art-30-par-5-nl

De in de leden 1 en 2 bedoelde verplichtingen zijn niet van toepassing op ondernemingen of organisaties die minder dan 250 personen in dienst hebben, tenzij het waarschijnlijk is dat de verwerking die zij verrichten een risico inhoudt voor de rechten en vrijheden van de betrokkenen, de verwerking niet incidenteel is, of de verwerking bijzondere categorieën van gegevens, als bedoeld in artikel 9, lid 1, of persoonsgegevens in verband met strafrechtelijke veroordelingen en strafbare feiten als bedoeld in artikel 10 betreft.

### GDPR — gdpr-art-33-par-5-nl

De verwerkingsverantwoordelijke documenteert alle inbreuken in verband met persoonsgegevens, met inbegrip van de feiten omtrent de inbreuk in verband met persoonsgegevens, de gevolgen daarvan en de genomen corrigerende maatregelen. Die documentatie stelt de toezichthoudende autoriteit in staat de naleving van dit artikel te controleren.

### GDPR — gdpr-art-35-par-3-nl

Een gegevensbeschermingseffectbeoordeling als bedoeld in lid 1 is met name vereist in de volgende gevallen:

### GDPR — gdpr-art-35-par-4-nl

De toezichthoudende autoriteit stelt een lijst op van het soort verwerkingen waarvoor een gegevensbeschermingseffectbeoordeling overeenkomstig lid 1 verplicht is, en maakt deze openbaar. De toezichthoudende autoriteit deelt die lijsten mee aan het in artikel 68 bedoelde Comité.

### GDPR — gdpr-art-35-par-5-nl

De toezichthoudende autoriteit kan ook een lijst opstellen en openbaar maken van het soort verwerking waarvoor geen gegevensbeschermingseffectbeoordeling is vereist. De toezichthoudende autoriteit deelt deze lijst mee aan het Comité.

### GDPR — gdpr-art-37-par-1-nl

De verwerkingsverantwoordelijke en de verwerker wijzen een functionaris voor gegevensbescherming aan in elk geval waarin:

### GDPR — gdpr-art-40-par-1-nl

De lidstaten, de toezichthoudende autoriteiten, het Comité en de Commissie bevorderen de opstelling van gedragscodes die, met inachtneming van de specifieke kenmerken van de diverse gegevensverwerkingssectoren en de specifieke behoeften van kleine, middelgrote en micro-ondernemingen, moeten bijdragen tot de juiste toepassing van deze verordening.

### GDPR — gdpr-art-42-par-2-nl

Ter aanvulling op de naleving door verwerkingsverantwoordelijken of verwerkers die onder deze verordening vallen, kunnen tevens uit hoofde van lid 5 van dit artikel goedgekeurde certificeringsmechanismen voor gegevensbescherming, gegevensbeschermingszegels of -merktekens worden ingevoerd om aan te tonen dat de verwerkingsverantwoordelijken of verwerkers die overeenkomstig artikel 3 niet onder deze verordening vallen, in het kader van de doorgiften van persoonsgegevens aan derde landen of internationale organisaties onder de voorwaarden als bedoeld in artikel 46, lid 2, punt f), passende waarborgen bieden. Die verwerkingsverantwoordelijken of verwerkers doen, via contractuele of andere juridisch bindende instrumenten, bindende en afdwingbare toezeggingen om die passende waarborgen toe te passen, ook wat betreft de rechten van de betrokkenen.

### GDPR — gdpr-art-2-nl

Materieel toepassingsgebied

### GDPR — gdpr-art-4-nl

Voor de toepassing van deze verordening wordt verstaan onder:

### GDPR — gdpr-art-5-nl

Beginselen inzake verwerking van persoonsgegevens

### GDPR — gdpr-art-6-nl

Rechtmatigheid van de verwerking

### GDPR — gdpr-art-9-nl

Verwerking van bijzondere categorieën van persoonsgegevens

### GDPR — gdpr-art-10-nl

Persoonsgegevens betreffende strafrechtelijke veroordelingen en strafbare feiten of daarmee verband houdende veiligheidsmaatregelen mogen op grond van artikel 6, lid 1, alleen worden verwerkt onder toezicht van de overheid of indien de verwerking is toegestaan bij Unierechtelijke of lidstaatrechtelijke bepalingen die passende waarborgen voor de rechten en vrijheden van de betrokkenen bieden. Omvattende registers van strafrechtelijke veroordelingen mogen alleen worden bijgehouden onder toezicht van de overheid.

### GDPR — gdpr-art-15-nl

Recht van inzage van de betrokkene

### GDPR — gdpr-art-16-nl

De betrokkene heeft het recht om van de verwerkingsverantwoordelijke onverwijld rectificatie van hem betreffende onjuiste persoonsgegevens te verkrijgen. Met inachtneming van de doeleinden van de verwerking heeft de betrokkene het recht vervollediging van onvolledige persoonsgegevens te verkrijgen, onder meer door een aanvullende verklaring te verstrekken.

### GDPR — gdpr-art-18-nl

Recht op beperking van de verwerking

### GDPR — gdpr-art-28-nl

Verwerker

### GDPR — gdpr-art-29-nl

De verwerker en eenieder die onder het gezag van de verwerkingsverantwoordelijke of van de verwerker handelt en toegang heeft tot persoonsgegevens, verwerkt deze uitsluitend in opdracht van de verwerkingsverantwoordelijke, tenzij hij Unierechtelijk of lidstaatrechtelijk tot de verwerking gehouden is.

### GDPR — gdpr-art-30-nl

Register van de verwerkingsactiviteiten

### GDPR — gdpr-art-35-nl

Gegevensbeschermingseffectbeoordeling

### GDPR — gdpr-art-37-nl

Aanwijzing van de functionaris voor gegevensbescherming

### GDPR — gdpr-art-40-nl

Gedragscodes

### GDPR — gdpr-art-42-nl

Certificering

### GDPR — gdpr-art-52-nl

Onafhankelijkheid

### GDPR — gdpr-art-4-par-16-nl

„hoofdvestiging”: a) met betrekking tot een verwerkingsverantwoordelijke die vestigingen heeft in meer dan één lidstaat, de plaats waar zijn centrale administratie in de Unie is gelegen, tenzij de beslissingen over de doelstellingen van en de middelen voor de verwerking van persoonsgegevens worden genomen in een andere vestiging van de verwerkingsverantwoordelijke die zich eveneens in de Unie bevindt, en die tevens gemachtigd is die beslissingen uit te voeren, in welk geval de vestiging waar die beslissingen worden genomen als de hoofdvestiging wordt beschouwd; b) met betrekking tot een verwerker die vestigingen in meer dan één lidstaat heeft, de plaats waar zijn centrale administratie in de Unie is gelegen of, wanneer de verwerker geen centrale administratie in de Unie heeft, de vestiging van de verwerker in de Unie waar de voornaamste verwerkingsactiviteiten in het kader van de activiteiten van een vestiging van de verwerker plaatsvinden, voor zover op de verwerker krachtens deze verordening specifieke verplichtingen rusten;

### GDPR — gdpr-art-9-par-2-pnt-b-nl

de verwerking is noodzakelijk met het oog op de uitvoering van verplichtingen en de uitoefening van specifieke rechten van de verwerkingsverantwoordelijke of de betrokkene op het gebied van het arbeidsrecht en het socialezekerheids- en socialebeschermingsrecht, voor zover zulks is toegestaan bij Unierecht of lidstatelijk recht of bij een collectieve overeenkomst op grond van lidstatelijk recht die passende waarborgen voor de grondrechten en de fundamentele belangen van de betrokkene biedt;

### GDPR — gdpr-art-35-par-3-pnt-b-nl

grootschalige verwerking van bijzondere categorieën van persoonsgegevens als bedoeld in artikel 9, lid 1, of van gegevens met betrekking tot strafrechtelijke veroordelingen en strafbare feiten als bedoeld in artikel 10; of

### GDPR — gdpr-art-37-par-1-pnt-a-nl

de verwerking wordt verricht door een overheidsinstantie of overheidsorgaan, behalve in het geval van gerechten bij de uitoefening van hun rechterlijke taken;

---
Generated by overview.legal · https://overview.legal/posts/50980 · 2026-08-22