In short. A business with fewer than 250 employees must record processing covered by any Article 30(5) exception, including regular processing of employee data.
Definition: A record of processing activities describes how an organisation handles personal data, meaning information about identified or identifiable people. The General Data Protection Regulation (GDPR), Article 30(5), gives organisations employing fewer than 250 people a conditional exemption: risk to individuals, regular processing or certain sensitive data can each require records.
As of October 2026, the European Parliament's procedure file for the proposed amendment lists it as awaiting Parliament's position at first reading.
Key facts
- GDPR Article 30(5) sets the threshold at fewer than 250 persons and attaches exceptions to the processing carried out.
- The Article 29 Working Party's position paper explains that any one exception triggers record-keeping for the relevant activities.
- The European Data Protection Board's small-business guide identifies payroll management and lists of prospective customers as examples of activities to examine when compiling a record.
Which processing requires records below the threshold?
Processing includes collecting, storing and using personal data, under Article 4 of the GDPR.
Article 30(5) removes the exemption for processing likely to result in a risk to individuals' rights and freedoms, processing that is not occasional, or processing involving special categories of personal data or criminal conviction and offence data. Special categories under Article 9(1) include health data and biometric data used to identify someone uniquely; criminal conviction and offence data falls under Article 10.
The Working Party's position paper specifies that the risk exception covers a risk to individuals' rights, without requiring a high risk. The exceptions operate independently, so regular processing can require records even where the other exceptions are absent.
Must every activity appear once an exception applies?
For an organisation below the threshold, the Working Party's position paper limits mandatory records to the types of processing covered by Article 30(5). Its example is a small organisation regularly processing employee data: that activity belongs in the record.
The paper describes occasional processing as activity outside the regular course of business that is not carried out regularly. Other genuinely occasional activities can remain outside the record when they are unlikely to result in a risk to individuals' rights and freedoms and involve neither special categories nor criminal conviction and offence data.
What information belongs in the record?
A controller decides the purposes and means of processing; a processor handles personal data on the controller's behalf, under Article 4 of the GDPR.
Article 30(1) requires a controller's record to include its name and contact details, purposes, categories of people and personal data, recipient categories and applicable international transfers. Where possible, it also includes envisaged erasure time limits and a general description of technical and organisational security measures. Applicable representative, joint-controller and data protection officer details also belong in the record.
Article 30(2) gives processors a separate record obligation covering categories of activities performed for each controller, relevant contact details, applicable international transfers and, where possible, a general description of security measures. Under both paragraphs, certain international transfers also require documentation of suitable safeguards.
Related terms
FAQ
Can you keep the record electronically?
Yes. GDPR Article 30(3) requires written records and expressly includes electronic form. Article 30(4) requires you to make the record available to the supervisory authority on request.
Does employing exactly 250 people qualify?
No. Article 30(5) uses “fewer than 250 persons”, so an organisation employing exactly 250 people falls outside that exemption.
Does a records exemption remove your other GDPR duties?
The exemption in Article 30(5) concerns the record obligations in paragraphs 1 and 2. Article 5(2) separately requires a controller to take responsibility for, and demonstrate compliance with, the personal-data processing principles.
Sources
- EUR-Lex, "General Data Protection Regulation", 27 April 2016
- Article 29 Working Party, "Position paper on the derogations from the obligation to maintain records of processing activities pursuant to Article 30(5) GDPR", 19 April 2018
- European Commission, "Position Paper related to article 30(5)", 19 April 2018
- European Data Protection Board, "Be compliant", undated
- European Parliament, "Procedure File: 2025/0130(COD)", undated
Check how a page reads to answer engines. Open the GEO score analyzer