Short Reads

Countdown 4 weeks until GDPR : Will data controllers be required to maintain records of processing activities in all cases?

Stibbe - Will data controllers be required to maintain records

Countdown 4 weeks until GDPR : Will data controllers be required to maintain records of processing activities in all cases?

26.04.2018 EU law

Only 4 more weeks to go before the GDPR becomes fully effective. Preparing your company for the application of this new regulation requires a correct understanding of its principles. Each week, we highlight one particular misconception regarding the interpretation of the GDPR.

Will data controllers be required to maintain ​r​ecords of ​processing activities in all cases?

The GDPR requires each controller to keep a record of processing activities under its responsibility, and each processor to keep a record of the processing activities that it has carried out on behalf of a controller​​. However, these obligations do not apply if the controller or the processor is an enterprise or an organization employing fewer than 250 persons, unless the processing it carries out:

- is likely to result in a risk to the rights and freedoms of data subjects and is not occasional, or

- includes sensitive​ data, i.e., personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation (Article 9​ of the GDPR), ​or data relating to criminal convictions and offences (Article 10​ of the GDPR).

​The rationale for these exceptions is that ​small and medium-sized enterprises and organizations that do not carry out risky processing should be exempt from the requirement to keep a record of its processing activities.

 

Stibbe, together with Chiomenti, Cuatrecasas, GIDE and Gleiss Lutz, have gathered this useful information, reflecting some common misconceptions about the implementation of the GDPR.

Team

Related news

06.06.2019 BE law
TMT Roundtable: Getting a handle on software quality

Roundtable - Erik Valgaeren, TMT Partner at Stibbe Brussels, and his team organize a roundtable on software quality in our Brussels office on June 6th, 2019. Software quality is a recurring theme in many matters handled by our TMT team. Whether our assistance relates to preparing tender documents, contracting effectively, assessing proper performance or allocating ownership and accountability in challenging IT projects, questions concerning software quality always arise.

Read more

24.05.2019 EU law
One year of GDPR - The regulatory warm-up

Short Reads - The first year of the General Data Protection Regulation ("GDPR") is over. Although early noises predicted an entirely new data protection regime, the European legal framework did not change substantially, the major changes being an expansion of the territorial scope to non-EU countries and stronger powers of enforcement. In spite of fears and rumours of immediate enforcement and huge fines, most regulators focused on helping companies achieve compliance, or they enforced without directly imposing fines.

Read more

21.05.2019 EU law
Part one - GDPR and Public Law - Applicability of GDPR to public bodies

Articles - Since the GDPR became applicable almost one year ago, multiple questions have arisen about its interaction with other fields of law. In this three-part blog series of “GDPR and Public Law”, we discuss three relevant issues of the interaction of GDPR with public law and government. In this blog we discuss the applicability of GDPR to public bodies.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring