The under-250-employees records exemption
There is an exemption from the Article 30 record-keeping duty for companies with fewer than 250 people. But it is heavily caveated and the chapter says it will rarely be used. It does NOT apply - regardless of headcount - if the processing is likely to result in a risk to rights and freedoms, is frequent and not occasional, or involves special categories (or criminal convictions/offences data). The WP29 confirmed that only one of those triggers, alone, defeats the exemption.
The exemption applies to companies employing fewer than 250 people. But three carve-outs strip it away no matter the headcount, and the WP29 confirmed that any one of them alone is enough to trigger the full Article 30 obligation.
| Trigger (any one alone is enough) | Effect |
|---|---|
| Processing is likely to result in a RISK to rights and freedoms | Records must be kept |
| Processing is FREQUENT and not occasional | Records must be kept |
| Processing involves SPECIAL CATEGORIES (biometric, genetic, health, sex life/orientation) | Records must be kept |
| Data relate to criminal convictions and offences | Records must be kept |
Because most processing will be caught by at least one carve-out, the chapter concludes the exemption will rarely be used. Do not treat 'fewer than 250 employees' as a free pass.