Does my small company need a GDPR processing register?

Controller, Processor, SME

All controllers and processors; organisations under 250 employees only when processing is not occasional, is likely to result in a risk, or includes special categories or criminal data.

In practice yes for most SMEs, since regular processing such as payroll is not occasional.

Keep a written record with purposes, categories, recipients, transfers, retention periods and security measures.

high (fine_cap_pct_turnover)

1. List each processing activity
2. Record the Article 30 content per activity
3. Keep the record up to date
4. Make it available to the authority on request

No fixed date; the record must be kept current and provided on request.

• GDPR Art. 30
• GDPR Art. 83(4)

sha256 eb5ee97debcf93a1b1385541e13dd28155d143e4c6705c5ae26937fd09c23176 · read 2026-10-15 · Source: NovaCopilot

• Does the California privacy law apply to my business?
• Do I need parental consent to collect data from children?
• What must a clinic do after a health data breach?
• Must I report a data breach to the authority?
• How fast must I answer a request for personal data?

• eu:gdpr (action_kit)
• agent:eu:business:gdpr-access-request (business_agent)
• agent:eu:business:gdpr-breach-72h (business_agent)
• agent:us:business:ccpa-consumer-requests (business_agent)
• agent:us:business:coppa-parental-consent (business_agent)
• agent:us:business:hipaa-breach-notification (business_agent)
• agent:us:business:privacy-access-request (business_agent)
• agent:us:business:privacy-consumer-request (business_agent)
• agent:us:business:privacy-deletion (business_agent)
• agent:us:business:privacy-notice (business_agent)