# Art. 30(5) Exemption Assessment Workflow

## Assessment Process

### Step 1: Employee Count Verification

1. Determine the headcount of the specific legal entity (not the group).
2. Include all employees: full-time, part-time, fixed-term, working students, interns.
3. Exclude independent contractors (who are not employees of the entity).
4. If headcount is 250 or more, the exemption does not apply. Stop — full RoPA required.
5. If headcount is fewer than 250, proceed to Step 2.

### Step 2: Processing Activity Inventory (Simplified)

Even to assess whether the exemption applies, the organisation must understand what processing it carries out. Create a simplified inventory:

1. List all categories of personal data processed by the organisation.
2. For each category, note:
   - Who the data subjects are (employees, customers, suppliers, visitors)
   - How often the processing occurs (daily, weekly, monthly, annually, one-time)
   - Whether any special category data (Art. 9(1)) is involved
   - Whether any criminal conviction data (Art. 10) is involved

### Step 3: Exception Condition Assessment (Per Activity)

For each processing activity identified:

#### Condition 1: Risk Assessment

- Does this processing involve personal data that, if compromised, could cause harm to data subjects?
- Harm includes: financial loss, identity theft, reputational damage, discrimination, loss of employment, emotional distress, physical harm.
- If any processing activity creates any level of risk to data subjects, this condition is met.

#### Condition 2: Occasional vs Non-Occasional

- Is this processing a regular, recurring, or systematic part of the organisation's operations?
- If the organisation would continue to process this data as part of its normal business, it is not occasional.
- Only truly one-time, ad hoc activities with no planned repetition may qualify as occasional.

#### Condition 3: Special Category or Criminal Data Check

- Does any processing activity involve any of the Art. 9(1) categories?
- Pay particular attention to:
  - Sick leave records (health data)
  - Religious affiliation/church tax (religious beliefs)
  - Diversity monitoring (racial/ethnic origin)
  - Trade union membership deductions
  - Biometric access control (biometric data)
  - Background checks (criminal data under Art. 10)

### Step 4: Determination

- If **any** exception condition is met for **any** processing activity, the exemption does not apply for that activity, and a RoPA entry must be maintained.
- In practice, most organisations will find that the majority of their processing activities fail at least one exception condition.
- **Recommendation**: Even if some activities technically qualify for the exemption, document all processing in a RoPA for accountability purposes.

### Step 5: Documentation

Regardless of the assessment outcome, document:

1. The date of the assessment.
2. The employee count at the time of assessment.
3. The processing activities assessed.
4. Which exception conditions were met for each activity.
5. The conclusion: exemption available or not available.
6. The decision: maintain full RoPA, partial RoPA, or no RoPA (with reasoning).

This documentation itself demonstrates accountability under Art. 5(2).

## Simplified RoPA Approach for Small Organisations

For organisations under 250 employees that determine they must maintain a RoPA (which is virtually all), a simplified approach is appropriate:

### Minimum Viable RoPA for a Small Organisation

A small organisation with 5-15 processing activities can maintain a RoPA in a structured spreadsheet:

| Column | Maps to Art. 30(1) | Content |
|--------|---------------------|---------|
| Processing Activity Name | — | Descriptive name |
| Purpose | (b) | Why we process this data |
| Lawful Basis | — (recommended) | Art. 6(1) basis |
| Data Subject Categories | (c) | Who the data is about |
| Personal Data Categories | (c) | What data we hold |
| Special Category? | Art. 9 check | Yes/No + Art. 9 condition if yes |
| Recipients | (d) | Who receives the data |
| International Transfers | (e) | Countries + safeguard |
| Retention Period | (f) | How long + deletion method |
| Security Measures | (g) | How data is protected |
| Last Reviewed | — (recommended) | Date of last review |

### Typical Processing Activities for a Small Organisation

1. Employee HR records management
2. Employee payroll processing
3. Customer/client relationship management
4. Supplier/vendor management
5. Website operation (contact forms, analytics)
6. Email and communication systems
7. CCTV (if applicable)
8. Recruitment and job applicant management
9. Marketing and newsletters (if applicable)
10. Accounting and financial records

### RACI for Small Organisation RoPA

| Activity | Responsible | Accountable |
|----------|------------|-------------|
| Initial RoPA creation | DPO (or external DPO) | Managing Director |
| Annual review | DPO (or external DPO) | Managing Director |
| Ongoing updates | Office manager / admin | DPO |
| DPIA assessment (if needed) | DPO (or external DPO) | Managing Director |