Art. 24

Undertakings and other private organisations employing fewer than 250 employees on 1 January of any year and natural persons are exempt from the obligation to keep a record of processing activities unless any one of the following requirements is met:

1. a large volume of sensitive personal data is being processed;
2. high-risk profiling is being carried out.