European Union: European Data Protection Board and European Data Protection Supervisor adopted joint letter on European Commission's draft proposal on simplification of record-keeping under the General Data Protection Regulation

On 8 May 2025, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) adopted a joint letter addressed to the European Commission concerning the draft proposal on the simplification of record-keeping obligations under Regulation (EU) 2016/679 General Data Protection Regulation (GDPR). The proposal specifically focuses on amending Article 30(5) to potentially extend certain derogations to small mid-cap companies and non-profits with fewer than 500 employees. It also amends the conditions so that the exemption would no longer apply to processing activities likely to result in a high risk to individuals’ rights and freedoms. The letter noted proposed changes, including limiting the derogation, removing the exception for occasional processing, and potentially narrowing the exemption regarding special categories of data. The letter welcomed a recital clarifying that processing special categories of data for compliance with legal obligations in employment or social protection law would not trigger record-keeping duties. While expressing preliminary support, the EDPB and EDPS called for further analysis of the proposal’s impact, including the number of entities affected and the implications for data protection, and confirmed they would provide detailed input during the formal consultation phase.