Simplification of record-keeping responsibility under the GDPR

Currently, Article 30(5) GDPR requires enterprises with fewer than 250 employees to maintain records of processing activities when handling special categories of personal data under Articles 9(1) or 10 GDPR, due to the potential high-risk nature of such processing. The Proposal offers an alternative, removal of current Article 30(5) in favour of risk-based approach where the duty to keep records would only apply if the processing were likely to result in high-risk, regardless of the type of data processed. The Proposal also raises the employee threshold for the exemption under this article from 250 to 750 employees. 

EDPB and EDPS brought up multiple concerns, however, supported the change if it is aligned with GDPR principles and if a point is made to highlight that record-keeping remains a valuable tool for ensuring compliance. They emphasized that organizations should continue using appropriate methods to demonstrate GDPR compliance and to safeguard data subjects’ rights, even if exempt from mandatory record-keeping under the proposed changes. Such an amendment would exempt 38,000 SMCs in addition to the 26 million SMEs from record-keeping duty based on their size. 

In Latvia, the simplification of record-keeping is widely regarded as a step in the right direction. This aligns with one of the government’s key priorities – reducing bureaucratic burdens for businesses. Given that many Latvian companies fall under the 750-employee threshold, the proposed amendments to data processing regulations offer tangible benefits. While companies involved in high-risk data processing (such as handling health data, customer profiling, or large-scale data matching) may still face stricter obligations, those not engaged in such activities stand to gain significantly from the streamlined requirements. This approach supports a more efficient and innovation-friendly business environment, particularly for the country’s numerous SMEs.​