EU moves to simplify GDPR – what it means for you
The situation
The GDPR has been in force since 2018 and set the global benchmark for personal-data protection.
But many small and medium-sized businesses (SMBs) inside the EU felt they were weighed down by compliance overhead: heavy documentation, processing-records, templates, audits.
The European Commission has now formally proposed amendments that aim to reduce the administrative burden—especially for smaller organisations—while stating that the core rights of individuals will remain intact.
What’s changing?
Here are the key proposed modifications:
- Extension of the exemption from full record-keeping under Article 30: organisations with fewer than 750 employees (under certain conditions) would be able to skip keeping full “records of processing activities”, unless they carry out high-risk processing.
- Broadening of scope for “codes of conduct” (Art. 40) and “certification mechanisms” (Art. 42) so that “small mid-cap enterprises” (SMCs) can also use these more flexible tools.
- The intention is to lower the overall administrative burden by about 25 % and for SMBs around 35 % by year 2029.
Why this matters
For businesses:
If adopted, the proposal could reduce some record-keeping work for businesses within scope.
For regulators & consumers:
The practical effect will depend on the final rules and their implementation in member states.
For privacy rights:
Even though the burden is being eased, the core protections remain non-negotiable. The EDPB/EDPS emphasise the regulation’s foundations must stay intact.
But there are valid concerns
- The number of organizations that benefit depends on the final eligibility conditions.
- Different requirements for smaller and larger organizations would need clear eligibility rules.
- Simplification should preserve the protection of individuals’ rights.
What businesses should review
If you’re running compliance services (or commissioning them) here’s how to think about it:
- Don’t wait for the final legal text. The proposal is published, but the law hasn’t changed yet. The timeline still has many stages: consultations, amendments, parliamentary debates.
- Keep the fundamentals strong. Regardless of simplification, you’ll still need to comply with core principles: lawful basis, transparency, data subject rights, security. The protection goal does not change.
- Review your documentation for duplicated work and unnecessary steps while preserving required records.
- Tailor based on size and risk profile. If you’re advising smaller clients (say under 750 employees or less), highlight how these proposed changes might reduce burdens—but also remind them that high-risk processing still triggers full obligations.
- Prepare for change management. Once the law is updated, your clients will need to update policies, records, possibly consent frameworks, and internal risk-assessments. Position yourself to help with that “transition” phase.
Assessment of the proposal
Our assessment is that simpler documentation could reduce administrative work. Its value depends on the final scope and whether organizations can still demonstrate that they protect personal data.
What to do now (action checklist)
- Conduct a mini-audit: Identify whether your organisation (or your client’s) is under 750 employees, what processing is “high-risk”, what records are maintained today.
- Map current processing operations: even if some records may become exempt, still good practice to have a clear picture.
- Review your consent management frameworks, internal documentation (DPAs, DPIAs, records of activities) — spot potential efficiencies.
- Distinguish proposed changes from current duties in client communications.
- Monitor legislative progress: Stay tuned to the official law-making, as the draft could be amended further. The European Data Protection Board and European Data Protection Supervisor have issued opinions already.
Before changing procedures
The proposed changes could reduce some record-keeping duties. Organizations should check the final scope and effective dates before changing their procedures.
Sources:
UsercentricsEuropean CommissionEuropean Data Protection Board (EDPB)European Data Protection Supervisor (EDPS)BEUC – The European Consumer OrganisationRelated guidance and practical next steps
