EDPB-EDPS Letter on European Commission draft proposal on simplification of record-keeping under the GDPR

Anu Talus Chair of the European Data Protection Board Wojciech Rafał Wiewiórowski European Data Protection Supervisor Commissioner Michael McGrath Democracy, Justice, the Rule of Law and Consumer Protection European Commission Rue de la Loi 200 B-1049 Brussels Brussels, 8 May 2025 Subject: Commission draft proposal on the simplification of record-keeping obligation under Regulation (EU) 2016/679 (GDPR) Dear Commissioner McGrath, With this letter, we are jointly replying to the letters which you sent to us on 6 May 2025 concerning the Commission draft proposal on the simplification of record-keeping obligations under the GDPR (“draft Proposal”) which is planned to be part of the Fourth Omnibus to be adopted in May 2025. The EDPB and EDPS understand that the Commission is considering to propose extending the derogation provided under Article 30(5) GDPR to the obligation to maintain records of processing that is currently applicable to enterprises or organisations with less than 250 employees (including small and medium-sized enterprises or SMEs) to cover “small mid-cap companies” (SMCs) i.e. companies with fewer than 500 employees and with a certain annual turnover, as well as organisations such as non-profits with fewer than 500 employees. In addition, the Commission considers modifying Article 30(5) GDPR to provide that the derogation would not apply if the processing is “likely to result in a high risk to the rights and freedoms of natural persons”, whereas...