Art. 30(5) Exemption Assessment

Overview

GDPR Article 30(5) provides a limited exemption from the RoPA obligation for organisations with fewer than 250 employees. However, this exemption is narrowly constructed and rarely available in practice. The exemption does not apply when any of three exception conditions are met: (1) the processing is likely to result in a risk to data subjects' rights and freedoms, (2) the processing is not occasional, or (3) the processing includes special category data under Art. 9(1) or criminal conviction data under Art. 10. Since virtually all organisations with regular employee or customer processing engage in non-occasional processing, the EDPB has recommended that all organisations maintain RoPA regardless of size.

Art. 30(5) Text

The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

Three Exception Conditions

The exemption is negated (RoPA is required) if any one of the following three conditions is met. They are disjunctive (OR), not conjunctive (AND).

Exception 1: Processing Likely to Result in a Risk

Test: Does the processing carried out by the organisation result in any risk (not just high risk) to the rights and freedoms of data subjects?

EDPB interpretation: The EDPB Position Paper on Art. 30 (2018) interpreted this condition broadly. Unlike Art. 35 (DPIA), which requires "high risk," Art. 30(5) refers to "a risk" — a lower threshold. The EDPB concluded that virtually all processing of personal data involves some risk to data subjects, making this condition almost always met.