WP29 On The Derogations From The Obligation To Maintain Records Of Processing Activities

Background

On April 19^th 2018 the Article 29 Working Party (hereinafter, the "WP29") published a position paper on the derogations from the obligation to maintain records of processing activities contained in Article 30 (5) of the EU General Data Protection Regulation ("GDPR").

Main issues

Under Article 30 of the GDPR, controllers and processors of personal data are required to maintain records of processing activities carried out under their responsibility or carried out on behalf of the controller.

However, by virtue of Article 30 (5), organisations or enterprises employing fewer than 250 persons are exempted from that obligation, unless where

• the processing is likely to result in a high risk to the rights of the data subject;