The Article 30(5) exemption, and why it rarely gets you out of a ROPA

Article 30(5) looks like it excuses organisations under 250 staff from keeping a record of processing. Read the conditions attached and almost nobody qualifies.

Article 30(5) is the most misread sentence in the accountability provisions. It is commonly summarised as an exemption for organisations with fewer than 250 employees. The staff count is real, but it is the start of the test rather than the whole of it.

What the provision actually says

The under-250 threshold applies unless one of three things is true. The exemption falls away if the processing is likely to result in a risk to the rights and freedoms of data subjects, if the processing is not occasional, or if the processing includes special categories of data under Article 9 or data relating to criminal convictions and offences under Article 10.

Those are alternatives, not a checklist you have to fail entirely. Any one of them puts you back inside the obligation.

The second condition is the one that decides most cases. Processing that happens continuously as part of running the organisation is not occasional, whatever its scale.

Why almost every organisation fails the test

Consider what a ten-person company processes as a matter of routine:

• Payroll and HR records for its own staff, processed every month.
• Customer contact details and order history, processed continuously.
• Sickness absence records, which are health data and therefore special category.
• Marketing lists, processed on an ongoing basis.

The first two are not occasional. The third is special category data. On the plain wording, the exemption is gone before you reach the customer list.

The ICO's documentation guidance reflects this, and its position is that most organisations will need to document at least some of their processing. Treating the staff threshold as a blanket exemption is the failure mode worth avoiding.

What the exemption gives you when it does apply

It is narrower than it looks even when it holds. The exemption is from the record-keeping obligation in Article 30, not from anything else. Accountability under Article 5(2) still requires you to demonstrate compliance, and the practical way to do that is a written record of what you process and why.

So an organisation that genuinely qualifies still needs something that looks a great deal like a record of processing in order to answer a regulator, respond to a subject access request, or run a retention review. The exemption removes a formal requirement, not the underlying need.

The practical advice

Keep the record. The argument for relying on the exemption is that a ROPA is work, and it is. The argument against is that you need the same information for four other purposes, and constructing it under time pressure during an incident is considerably more work than maintaining it.

Start with the processing you know about, note where the data sits, and accept that the first version is incomplete. A partial record that reflects reality is more use than a complete one that describes an intended architecture.

How EmberHound fits

The column that decays fastest in any record of processing is the one naming where the data is held. Systems get named accurately; the exports, local copies and mailboxes those systems feed do not.

EmberHound scans enrolled company devices and reports personal data by category and location, which gives that column something observed to rest on. The ROPA capability is available inside the GDPR plans, and a standalone ROPA Workspace is in early access.

This article is general information, not legal advice. Confirm the obligations that apply to your organisation before acting on it.