The short answer
The GDPR applies to virtually every organization that processes personal data, regardless of size. This means that an installation company with four employees, a one-person business with customers, or a foundation with volunteers all fall under the regulation in principle as soon as names, email addresses, salary data, or other personal data are recorded. For maintaining a processing register, the GDPR provides an exception for organizations with fewer than 250 employees, but that exception only applies if a number of conditions are met simultaneously.
In practice, few SMEs meet all those conditions, simply because payroll administration, a customer database, or camera footage is quickly regarded as ongoing processing. Whether the exception applies precisely to your organization is something you can best determine by reviewing the regulation itself or consulting a legal professional; this article describes when the question becomes relevant and what you should look out for.
What the exception actually entails
The GDPR specifies in Article 30(5) that the obligation to maintain a processing register does not apply to organizations with fewer than 250 employees, unless the processing they carry out presents a risk to the rights and freedoms of data subjects, is not occasional, or concerns special categories of personal data such as health data. All these exceptions to the exception are there for a reason: the legislator wanted to exempt small organizations from the formal register obligation only in specific, limited cases, not from maintaining oversight.
The word "occasional" is the most determining in this regard. Payroll administration that runs every month, a customer database you update daily, or cameras that continuously record footage, are not occasional processing. As soon as processing is a structural part of business operations, the exception quickly falls out of reach.
When this question is relevant for you
The question "does this apply to me" is especially relevant for sole proprietors without employees and without a fixed customer database, who send an invoice occasionally and otherwise record little personal data. For them, the exception may apply in theory. As soon as employees are added, a CRM system is used, applications are retained, or a website collects visitor data via cookies or a contact form, there is almost always structural processing involved and the exception no longer applies.
An installation company with payroll administration, a scheduling system with customer data, and perhaps a camera at the workshop thus falls outside the exception. An HR manager managing application data, absence records, and salary data is already engaged in structural processing. For these businesses, a processing register is not only a legal matter, but also practically useful: it provides at a glance an overview of which systems contain which data, who has access, and how long data is retained.
Why the register is useful even without an obligation
Regardless of whether the exception applies precisely, customers, insurers, and contracting parties increasingly ask organizations to demonstrate that they have control over their personal data. A processing register is the first document people ask for in this regard. Anyone who needs to explain which SaaS tools are used, which data processing agreements go with them, and who is responsible for what, will benefit from maintaining a register already in place, rather than having to put one together at the last minute.
That overview doesn't need to be complicated. It's about documenting for each processing which data it concerns, what purpose it serves, who has access to it, whether a third party is involved, and how long the data is retained. In the knowledge base with GDPR topics per situation what should be included for each type of processing is explained in detail, with references to the official text included.
How you assess this for your own situation
Whether your business falls under the exemption depends on the precise nature and frequency of the processing you carry out, and that is an assessment that differs per organization. The Dutch Data Protection Authority publishes guidelines on the scope of the record-keeping obligation, and to form an opinion on your specific situation it is advisable to consult those or involve a lawyer. What we do on gdpria.eu is bring structure: explain what the rule means, with source, so you can assess where you stand yourself. On the page about where our information comes from you can read how that connection with the legislation and guidelines works exactly.
Frequently discussed edge cases, such as a self-employed person with one regular client or a foundation with only volunteers, appear in frequently asked questions about the GDPR in practice. Often it turns out that the discussion about the exemption is less important than thought, because a clear overview of processing helps anyway in answering customer questions or handling a request from a data subject.
In short
The GDPR applies to virtually every organization that processes personal data. The exemption from the record-keeping obligation is narrow and only applies if the processing is incidental, poses no risk and does not concern special categories of data. For most SMEs with staff, customers or a website, that exemption is out of reach, and an overview of your own processing is mainly of practical value.
Want to quickly see where your own situation stands? Do the free quick-scan or browse through the topics on create a business account and get started yourself.