# Standards and Regulatory References — Art. 30(5) Exemption

## Primary Legislation

### GDPR Article 30(5)

- **Full text**: "The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10."

### Related GDPR Articles

- **Art. 9(1) — Special categories of personal data**: Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited (subject to the exceptions in Art. 9(2)).
- **Art. 10 — Processing of personal data relating to criminal convictions and offences**: Processing shall be carried out only under the control of official authority or when authorised by Union or Member State law.
- **Art. 5(2) — Accountability**: Even where the Art. 30(5) exemption technically applies, the accountability principle requires the controller to demonstrate compliance, which is significantly harder without processing records.
- **Art. 24(1) — Responsibility**: The controller must implement appropriate measures to ensure and demonstrate compliance, taking into account the nature, scope, context and purposes of processing and risks. This applies to all controllers regardless of size.
- **Recital 13**: Refers to account being taken of the specific situation of micro, small and medium-sized enterprises in the application of the regulation.
- **Recital 82**: Specifically references Art. 30 records and the accountability obligation, noting that records must be maintained "in order to demonstrate compliance with this Regulation."

## Regulatory Guidance

### EDPB

- **EDPB Position Paper on Art. 30 (adopted 19 April 2018)**: The definitive interpretation of Art. 30(5). Key conclusions:
  - The exemption should be interpreted narrowly.
  - "Not occasional" covers any regular or systematic processing, including standard business operations.
  - "A risk to rights and freedoms" is a lower threshold than "high risk" (used in Art. 35), meaning almost all processing involves some risk.
  - The EDPB recommends all organisations maintain RoPA regardless of employee count.

### National Supervisory Authorities

- **CNIL (France)**: Published simplified RoPA templates specifically for small organisations, acknowledging that even they need records. The CNIL's Facilita RGPD tool targets small businesses.
- **ICO (United Kingdom)**: Guidance explicitly states the exemption "is very limited" and recommends all organisations maintain records as a matter of good practice.
- **BfDI (Germany)**: States the exemption "hardly ever applies in practice" and recommends all organisations maintain records.
- **AEPD (Spain)**: Published the Facilita RGPD tool specifically to help SMEs create and maintain RoPA, demonstrating the SA's expectation that all organisations should maintain records.
- **CNDP (Morocco)**: Under Law 09-08, there is no size-based exemption at all, providing a comparison point.
- **Garante (Italy)**: Has enforced Art. 30 obligations against small organisations, confirming that the exemption is not a blanket waiver for SMEs.

## Enforcement Precedents

- **Polish DPA (UODO) — Decision against medical practice (2019)**: A small medical practice (fewer than 250 employees) was found non-compliant with Art. 30 because it processed patient health data (special category), negating the exemption under Exception 3.
- **Romanian DPA — Fine against small hospitality company (2019)**: A hotel with fewer than 250 employees was required to maintain RoPA because guest data processing was non-occasional (Exception 2) and included passport/ID data with potential risk (Exception 1).
- **Belgian DPA — Multiple decisions against SMEs**: The Belgian DPA has consistently held that small organisations processing customer or employee data engage in non-occasional processing, negating the exemption.

## EU SME Policy Context

- **EU SME Strategy (2020)**: While the EU promotes reducing regulatory burden on SMEs, the European Commission has not proposed expanding the Art. 30(5) exemption. The accountability principle and data protection rights are considered fundamental and not subject to size-based dilution.
- **EU Digital Strategy**: The digital transformation agenda increases data processing by SMEs (cloud services, e-commerce, digital marketing), further reducing the practical applicability of the Art. 30(5) exemption.