TL;DR
Art. 30(5) exempts organisations with fewer than 250 employees — unless the processing is likely to result in a risk, OR is not occasional, OR involves special categories or criminal-offence data. The three conditions are alternatives. Payroll is not occasional and contains health data: two of them apply at once.
The mistake is in the word «or»
Art. 30(5) exempts organisations employing fewer than 250 persons «unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10». Three conditions, joined by «or». The Art. 29 Working Party made this explicit in its position paper of 19 April 2018: they are alternatives, and a single one of them removes the exemption.
«Not occasional» closes the argument almost every time
Processing is occasional when it is not carried out regularly, is not part of the ordinary course of business and has no settled character. Payroll runs every month. Customer management never stops. Applications arrive all year. None of these is occasional, and the exemption has already fallen, regardless of headcount. Add sick notes and the special-categories carve-out under Art. 9(1) applies as well.
- The exemption is never total: at most it covers the processing operations that meet none of the three conditions. For all the others the record remains due — so an organisation keeps either a partial one or a complete one.
- Art. 30(1) lists the minimum content: name and contact details, purposes, categories of data subjects and of data, categories of recipients, third-country transfers with their safeguards, erasure deadlines and a general description of the Art. 32(1) measures.
- Processors keep their own record too (Art. 30(2)), with different content: it names the controllers they act for, not the purposes.
- Art. 30(4): the record must be made available to the supervisory authority on request. In practice it is the first document asked for.
What a template does not do
A template gives you the columns, not the content. The two fields where records routinely fail cannot be copied: the retention period, which differs by data category and jurisdiction, and the Art. 32 measures, which must match the technology actually in use. A record that says «statutory retention periods» everywhere does not answer the question — it avoids it.
The practical advice for advisers: do not open the 250 discussion at all. It costs half an hour and always ends the same way. The useful question is which processing operations exist and how long the data stays — because that is where the answer is missing, and that is exactly what the authority asks.
Looking for a workspace for your DPO work?
DPO Workspace is built by a certified DPO. 30-day free trial.
Start free
