Cybersecurity Policy Report, Simplification Initiative Gets Tentative Support From EU Privacy Regulators, (May 12, 2025)

By Tony Foley

The European Data Protection Board (EDPB) and European Data Protection Supervisor (EDPS) sent a letter last week to the European Commission (EC) in which they expressed preliminary support for the EC’s proposal to simplify recordkeeping obligations under the European Union’s General Data Protection Regulation (GDPR).

In a May 8 news release, the agencies noted that the letter was written in reply to a letter they received from the EC on May 6 that explained how the EC intended to introduce specific modifications to the GDPR. In that letter, the EC outlined its intention to extend the derogation from the obligation to maintain records of processing provided under GDPR article 30(5), which is currently applicable to enterprises or organizations with less than 250 employees, to also cover “small mid-cap companies,” defined as companies with fewer than 500 employees and with a specified annual revenue, as well as organizations like non-profits with fewer than 500 employees. The EC’s letter further notes that it is contemplating modifying article 30(5) to provide that the derogation would not apply if processing is likely to result in a “high risk” to the rights and freedoms of natural persons, as opposed to the current version, which refers to processing likely to result in a “risk,” as well as removing certain exceptions to the derogation.

The EDPB/EDPS letter said that, subject to a full analysis of the specific proposal, the agencies could express preliminary support for the targeted simplification initiative but reiterated that adoption of these measures would not affect the obligation of controllers and processors to comply with other GDPR obligations. The letter notes that the agencies would consider it helpful to understand the number of companies and organizations that would benefit from the proposed simplification and its impact on the protection of personal data through an analysis carried out by the EC.

The agencies also said they welcomed the fact that, even under the simplified rules, the obligation to keep records would still apply to “likely high-risk processing,” noting that even very small companies can engage in high-risk processing that requires a risk-based approach.

News: InternationalLegislation DataPrivacy GDPR