Edpb risponde su Commission draft proposal on the simplification of record-keeping obligation under Regulation (EU) 2016/679 (GDPR)

 
Brussels, 8 May 2025
Subject: Commission draft proposal on the simplification of record-keeping obligation under
Regulation (EU) 2016/679 (GDPR)

Dear Commissioner McGrath,
With this letter, we are jointly replying to the letters which you sent to us on 6 May 2025 concerning
the Commission draft proposal on the simplification of record-keeping obligations under the GDPR
(“draft Proposal”) which is planned to be part of the Fourth Omnibus to be adopted in May 2025.
The EDPB and EDPS understand that the Commission is considering to propose extending the
derogation provided under Article 30(5) GDPR to the obligation to maintain records of processing that
is currently applicable to enterprises or organisations with less than 250 employees (including small
and medium-sized enterprises or SMEs) to cover “small mid-cap companies” (SMCs) i.e. companies
with fewer than 500 employees and with a certain annual turnover, as well as organisations such as
non-profits with fewer than 500 employees.
In addition, the Commission considers modifying Article 30(5) GDPR to provide that the derogation
would not apply if the processing is “likely to result in a high risk to the rights and freedoms of natural
persons”, whereas the current provision merely refers to processing likely to result in a risk”.
Furthermore, we understand that certain exceptions to the derogation to maintain a record of
processing activities would be removed, in particular by deleting the references to occasional
processing and possibly also the reference to processing of special categories of data 1.
1 Your letter explicitly states that “The condition relating to occasional processing would be deleted”, without
explicitly referring to deletion of the following wording “unless [...] the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10”. We understand, however, that the recitals for the draft Proposal would be intended to narrow the exemption relating to special categories of data, stating that it is not intended to restrict the derogation if the processing is done for compliance with a legal obligation in the field of employment, social security or social protection law.

We also understand that a recital would clarify that the processing of special categories of personal
data to comply with a legal obligation in the field of employment, social security or social protection
law (in accordance with Article 9(2)(b) GDPR) would not be subject to the obligation to maintain a
record of these processing activities.

Based on the information available, and subject to a full analysis of the specific proposal, the EDPB
and EDPS can express preliminary support to this targeted simplification initiative, bearing in mind
that this would not affect the obligation of controllers and processors to comply with other GDPR
obligations. Nevertheless, in order to better evaluate the impact of the proposed modification, the
EDPB and EDPS consider it useful to understand, among other elements, the number of companies
and organisations that would benefit from the simplification in the draft Proposal and its impact on
the protection of personal data through an analysis carried out by the Commission. This would help
assessing whether the draft Proposal ensure a proportionate and fair balance between the protection
of personal data and the interests of organisations with less than 500 employees.

Given the importance of protecting data subjects under the GDPR, and of ensuring a balanced
approach to the simplification, the EDPB and EDPS welcome that the obligation to keep records would
in any event still be required for “likely high risk” processing. As you underlined, the EDPB Guidelines
on Data Protection Impact Assessment (DPIA) provide useful information on the notion of processing
“likely to result in a high risk”2. The EDPB and EDPS Recall that even very small companies can still
engage in high-risk processing and it is therefore important to retain a risk-based approach. In this
regard, the EDPB and EDPS also understand that non-occasional processing and processing of special
categories of personal data may still result in a likely high risk, depending on the outcome of the
assessment of all the relevant criteria3.

While this letter provides our preliminary feedback, the EDPB and EDPS understand that a formal
consultation will take place after the publication of the draft legislative change, in line with Article
42(2) of Regulation 2018/1725. This will also provide us with an opportunity to comment in more
detail the legislative change you intend to make on Articles 40(1) and 42(1) GDPR.
Yours sincerely,

Anu Talus Wojciech Rafał Wiewiórowski