🚨 NEW EDPB-EDPS Joint Opinion on SME Record-Keeping Simplification

On 9 July 2025, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) released their Joint Opinion 01/2025 on the proposed regulation to simplify record-keeping obligations for small and medium-sized enterprises (SMEs) and small mid-cap companies (SMCs).

🎯 Key Highlights:

  • Extended threshold: The proposal would raise the employee threshold from 250 to 750 employees for record-keeping exemptions under Art. 30(5) GDPR
  • Broader scope: SMCs (small mid-cap companies) would also benefit from simplified obligations
  • Risk-based approach maintained: High-risk processing activities would still require full compliance regardless of company size
  • Administrative burden reduction: Aims to provide greater flexibility for smaller organizations while maintaining data protection standards

💡 EDPB-EDPS Position: The authorities express preliminary support for this targeted simplification initiative, welcoming the risk-based approach that ensures fundamental rights protection remains intact. However, they’ve requested further clarification on the new 750-employee threshold and recommend better alignment with the newly introduced SME/SMC definitions.

This development represents a significant step toward making GDPR compliance more manageable for smaller organizations while preserving the regulation’s core protective principles.

📄 Source: https://www.edpb.europa.eu/our-work-tools/our-documents/edpbedps-joint-opinion/edpb-edps-joint-opinion-012025-proposal_en

We have updated our Privacy Resources to reflect this latest development.

#GDPR #DataProtection #Privacy #SME #Compliance #EDPB #EDPS #DataPrivacy #BusinessCompliance #PrivacyLaw