I read through Recital 13 in GDPR and it states

To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping.

However, I couldn't find an official definition of "record-keeping" pertaining to GDPR. I'm aware of what record-keeping is in a general sense, but I'm not sure how far the term goes in this context.

I'm assuming it includes such instances as a record of who accessed the data and when and what the data was/is used for. But I was hoping for a legal definition I could point to as proof.

For reference: https://gdpr-info.eu/recitals/no-13/

  • 1
    See Article 30(5) GDPR – wimh Jun 5 '18 at 21:03
  • 1
    The recital doesn't exempt anything, since recitals don't have direct legal effect. – phoog Jun 6 '18 at 14:18

See Article 30, Records of processing activities:

  1. Each controller and, where applicable, the controller’s representative, shall maintain a record of processing activities under its responsibility. ...
  2. Each processor and, where applicable, the processor’s representative shall maintain a record of all categories of processing activities carried out on behalf of a controller, containing: ...


  1. The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

Suitable Recitals (13) Taking account of micro, small and medium-sized enterprises (82) Record of processing activities

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.