Ropa 250 Exemption

Art. 30(5) Exemption Assessment

Overview

GDPR Article 30(5) provides a limited exemption from the RoPA obligation for organisations with fewer than 250 employees. However, this exemption is narrowly constructed and rarely available in practice. The exemption does not apply when any of three exception conditions are met: (1) the processing is likely to result in a risk to data subjects' rights and freedoms, (2) the processing is not occasional, or (3) the processing includes special category data under Art. 9(1) or criminal conviction data under Art. 10. Since virtually all organisations with regular employee or customer processing engage in non-occasional processing, the EDPB has recommended that all organisations maintain RoPA regardless of size.

Art. 30(5) Text

The obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data as referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10.

Three Exception Conditions

The exemption is negated (RoPA is required) if any one of the following three conditions is met. They are disjunctive (OR), not conjunctive (AND).

Exception 1: Processing Likely to Result in a Risk

Test: Does the processing carried out by the organisation result in any risk (not just high risk) to the rights and freedoms of data subjects?

EDPB interpretation: The EDPB Position Paper on Art. 30 (2018) interpreted this condition broadly. Unlike Art. 35 (DPIA), which requires "high risk," Art. 30(5) refers to "a risk" — a lower threshold. The EDPB concluded that virtually all processing of personal data involves some risk to data subjects, making this condition almost always met.

Examples of processing that creates risk:

Practical outcome: This condition alone makes the exemption unavailable for most organisations. Only processing that involves genuinely negligible risk (such as a one-time, paper-only process with immediate destruction) might satisfy this condition.

Exception 2: Processing Is Not Occasional

Test: Is the processing carried out on a regular or systematic basis, rather than being a one-time or infrequent occurrence?

"Occasional" means: One-time, infrequent, or ad hoc processing that is not part of the organisation's regular business operations. Examples might include a one-time market research survey conducted for a specific project with no repetition planned.

"Not occasional" (regular) processing includes:

EDPB guidance: The EDPB stated that any organisation processing employee or customer personal data as part of its ongoing operations is engaged in non-occasional processing. This includes virtually all businesses that employ staff or serve customers.

Practical outcome: Any organisation with employees, customers, suppliers, or a website is engaged in non-occasional processing, negating the exemption.

Exception 3: Special Category or Criminal Data

Test: Does the processing include any special category data under Art. 9(1) or criminal conviction data under Art. 10?

Art. 9(1) special categories:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data for identification purposes
• Health data
• Data concerning sex life or sexual orientation

Art. 10: Personal data relating to criminal convictions and offences or related security measures.

Common special category processing in small organisations:

Practical outcome: Almost all organisations process at least health data (sick leave) or religious data (in countries with church tax), making this condition met for most employers.

Exemption Assessment Flowchart

Does the organisation employ fewer than 250 persons?
│
├── No → Art. 30(5) exemption does NOT apply. Full RoPA required.
│
└── Yes → Assess three exception conditions:
    │
    ├── Condition 1: Is processing likely to result in a risk
    │   to data subjects' rights and freedoms?
    │   ├── Yes → Exemption does NOT apply for this processing.
    │   └── No → Continue to Condition 2
    │
    ├── Condition 2: Is the processing NOT occasional?
    │   (i.e., is it regular, recurring, or systematic?)
    │   ├── Yes (not occasional) → Exemption does NOT apply.
    │   └── No (truly occasional) → Continue to Condition 3
    │
    └── Condition 3: Does the processing include special
        category data (Art. 9(1)) or criminal data (Art. 10)?
        ├── Yes → Exemption does NOT apply.
        └── No → Exemption APPLIES for this specific processing
            activity. No RoPA entry required for this activity.

Critical point: The assessment is per processing activity, not per organisation. An organisation might have some processing activities that qualify for exemption and others that do not. In practice, the non-exempt activities (payroll, customer management, employee records) require a RoPA, and once you have a RoPA, you should document all processing for accountability purposes.

Assessment for Helix Biotech Solutions (Hypothetical Small Entity Scenario)

Assume Helix Biotech Diagnostics S.A.S. (recently acquired French subsidiary) has only 45 employees. Can it claim the Art. 30(5) exemption?

Employee Count Check

• Helix Biotech Diagnostics S.A.S.: 45 employees
• Threshold: fewer than 250 employees
• Result: Passes the employee count threshold.