Under which circumstances are controllers and processors not required to maintain records of personal data processing activities? The Personal Data Protection Law, modeled on the GDPR, sets out exceptions to the obligation for organizations with fewer than 250 employees to keep processing records. While this acknowledges the characteristics of small and medium-sized enterprises, ensuring they are not unnecessarily burdened with additional costs, the number of employees is not the sole criterion for exemption from the record-keeping obligation.
