If I have fewer than 250 members of staff, GDPR doesn’t apply to me, right?

New data protection law is due to come into force on 25 May 2018 in the form of the General Data Protection Regulation (GDPR). One of the many myths surrounding the new data law is that it doesn’t apply to businesses that have less than 250 employees.

Where has this myth come from?

To take SMEs into account, GDPR includes an exemption on record-keeping for businesses with less than 250 employees. However, it’s important to note that this does not make the business exempt from all other aspects and they are still required to comply with the rest of GDPR.

What record-keeping obligations do businesses have under GDPR?

Businesses must maintain records of the processing activities for which they are responsible or which they undertake on behalf of those who are responsible. There are different record-keeping requirements depending on whether a business is a controller (those that determine the purpose and means of processing of the personal data) or a processor (those responsible for processing the personal data on behalf of the controller). Article 30 of GDPR sets out in full the specific information that businesses must retain.

The records held by businesses must be kept in writing, including electronically, and be made available to a supervisory authority on request (in the UK the supervisory authority is the Information Commissioner’s Office).

What is the exemption?

The record-keeping obligations under the GDPR do not apply to businesses employing fewer than 250 employees. However, there are certain circumstances where such a business must continue to comply with the record-keeping obligations under GDPR. For example, where the processing includes data relating to criminal convictions or includes special categories of data such as racial or ethnic origin.

Record-keeping is, of course, just one of the many obligations that businesses have under the GDPR. There’s lots of helpful information on our website and we’d be happy to discuss how we can help.

Carmen Stevens
Posts: 9
Stars: 0
Date: 28/09/18
Deborah Sutton
Posts: 3
Stars: 0
Date: 09/08/18
Krystyna Ferguson
Posts: 5
Stars: 0
Date: 19/07/18
Daniel Murray
Posts: 3
Stars: 0
Date: 11/07/18
Simon Bates
Posts: 29
Stars: 0
Date: 21/06/18
Victoria McMeel
Posts: 3
Stars: 0
Date: 19/06/18
Adam Wadsley
Posts: 1
Stars: 0
Date: 05/06/18
Guest Blogger
Posts: 14
Stars: 0
Date: 11/04/18

Events & seminars

Browse our programme of training, seminars and special events.

Find out more

"Having the opportunity to tap into Jordans compliance and legal services when required is an added benefit to us and our clients"

Nimesh Pau, R Pau and Co


Keep informed with our free online newsletters and email updates.

Find out more