GDPR Simplification – What Is Changing?

On 21 May 2025, the European Commission published a proposal for a regulation that would amend the General Data Protection Regulation ("GDPR"). The proposal is part of the Commission's Fourth Omnibus Package and a first step towards simplifying the GDPR.

Key Changes to the GDPR

The most notable change is proposed to Article 30(5) of the GDPR. The Commission is proposing an exemption to small and mid-sized companies employing less than 750 people from the record-keeping obligation (also known as "ROPA"). The proposal raises the employee threshold from the current 250 to 750 employees, and the record-keeping is no longer dependent on whether processing is "occasional".

In practice, SMEs are only subject to mandatory record-keeping if they are carrying out processing that is likely to pose a "high risk". High risk is assessed in line with the existing Article 35 of the GDPR.