According to Article 30.5 of the GDPR, the obligation to keep a record of activities shall not apply to an enterprise or an organisation employing fewer than 250 persons, unless the processing is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.
In accordance with the position of the Article 29 Working Party on this issue, this provision should be interpreted as not applying to companies or organisations employing less than 250 people, unless any of the following circumstances apply:
- If there is likely to be a risk to the rights and freedoms of the data subjects.
- If the processing is not occasional.
- If it includes special categories of data (Art. 9 GDPR) or criminal offences and convictions.
Processing in which any of these circumstances apply must be included in the register.