GDPR Record Keeping Relief Extended to 750 Employees: Implications for UK SMEs

Executive Summary

The European Data Protection Board (EDPB) has welcomed significant proposed modifications to GDPR Article 30 record keeping obligations, potentially extending exemptions from 250 to 750 employees. This landmark development could provide substantial administrative relief for UK Small & Medium Enterprises, though post-Brexit complexities create unique challenges requiring careful analysis.

The Proposed Changes: What’s New

Current vs Proposed Thresholds

Currently, this derogation only applies to enterprises and organisation under 250 employees, except in certain cases. Under the Proposal, the derogation would apply to an enterprise or organisation employing fewer than 750 people, representing a threefold increase in the exemption threshold.

The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) have issued a joint opinion supporting these targeted modifications, emphasising that “the proposed modifications to simplify and clarify the obligation to keep a record of processing are targeted and limited in nature, and do not affect the core principles and other obligations under the GDPR”.

Key Provisions of the Proposal

The European Commission’s fourth simplification Omnibus introduces several critical changes:

1. Extended Employee Threshold: The derogation would apply to an enterprise or organisation employing fewer than 750 people, unless the processing operation carried out is likely to result in a high risk to individuals’ rights and freedoms

2. New Definitions: The Proposal introduces a definition of SME and SMC in Art.4 GDPR and extends the scope of Art.40 (1) and 42 (1) GDPR to the SMCs, which refer to codes of conduct and certification

3. Small Mid-Cap Recognition: The proposal extends benefits to Small Mid-Cap enterprises (SMCs), acknowledging the growing complexity of mid-tier organisations

Critical Analysis: UK SME Implications

Brexit Divergence Concerns

UK SMEs face a unique challenge as the UK government’s ongoing efforts to make data protection less burdensome for small and medium-sized enterprises (SMEs) are set to continue in 2025. However, this EU proposal creates potential regulatory divergence that could complicate compliance for UK businesses operating across borders.

Without the adequacy decisions being in place, organisations wishing to transfer personal data from the EU to the UK would face much greater compliance costs, making this GDPR simplification particularly significant for UK-EU trade relationships.

Cybersecurity Integration Challenges

The intersection of data protection and Cybersecurity creates particular complexities for SMEs:

1. Risk Assessment Requirements: Under current Article 30(5) GDPR, processing special categories of personal data or criminal conviction data necessitates record maintenance regardless of organizational size

2. High-Risk Processing: Many Cybersecurity activities involve high-risk data processing, potentially negating the benefits of increased thresholds

3. Compliance Burden: As we move into 2025, the focus shifts from legislation to implementation. EU and UK entities, alongside foreign businesses seeking market access, face mounting expectations to elevate cybersecurity practices

Potential Downsides for UK SMEs

Administrative Complexity Paradox

Whilst the proposal aims to reduce administrative burden, several factors could create unintended complications:

1. Dual Compliance Requirements: UK SMEs operating in EU markets may need to maintain separate compliance frameworks

2. Threshold Uncertainty: The European Data Protection Board (EDPB) has requested further clarifications on why the new threshold of enterprises or organisations employing fewer than 750 persons would be more appropriate under the GDPR, rather than the threshold of 500 employees initially considered

3. Definition Misalignment: The new exemption in Art. 30 (5) refers to ‘enterprises employing fewer than 750 employees’ without referring to the newly introduced definitions of SME and SMC, which also includes financial criteria

Cybersecurity Vulnerabilities

Reduced record keeping obligations could inadvertently create Cybersecurity risks:

1. Transparency Challenges: “The record of processing activities is a useful tool to support compliance with other duties, such as the one of transparency or to give effect to data subject rights”

2. Incident Response: Reduced documentation could complicate breach investigations and regulatory responses

3. Third-Party Assessments: A GDPR supervisory authority reviews an Article 30 report or an ROPA to assess whether your organization is taking all the recommended steps to ensure data integrity