Simplifying the GDPR: what may (perhaps) change

Why the GDPR is in the crosshairs of the European Commission

Since its entry into force in 2018, the GDPR has established itself as a global standard for data protection. Yet, it has also become the symbol of a regulation perceived as burdensome and complex by many companies, particularly SMEs.

Two criticisms regularly arise:

• A lack of support and resources to apply it correctly
• Inconsistent application across European countries

It is in this context that the European Commission, driven by the Draghi report, has announced its intention to contribute to the competitiveness of European companies by reducing their administrative burden. As such, the GDPR is now the target of a legislative simplification initiative.

# What the simplification proposal provides for

The European Commission presented on May 21, 2025 a draft update of the GDPR as part of the "Omnibus IV" package. This GDPR simplification primarily aims to:

• Extend the record-keeping exemption to organizations with fewer than 750 employees and turnover < €150 million
• Remove the "occasional processing" condition to avoid interpretation discrepancies
• Exempt these organizations from certain obligations such as DPIAs (Data Protection Impact Assessments)

Exception: processing operations presenting a high risk to rights and freedoms (Article 35) will remain subject to obligations.

The stated objective is clear: reduce paperwork for businesses while maintaining the overall GDPR framework.

# Focus: Article 30 and the Register of Processing Activities The register of processing activities is a key document for GDPR compliance. Article 30 sets out the obligation to maintain this register and specifies its content. ## Obligation to Maintain a Register Article 30 of the GDPR requires controllers and processors to maintain a register of processing activities under their responsibility. This register must be kept in writing, including in electronic form. ## Content of the Register The register must contain the following information: **For controllers:** - Name and contact details of the controller and, where applicable, joint controllers, the controller's representative and the data protection officer - Purposes of processing - Description of categories of data subjects and personal data - Categories of recipients to whom personal data have been or will be disclosed - Where applicable, transfers of personal data to third countries or international organizations - Where possible, the envisaged time limits for erasure of different categories of data - Where possible, a general description of technical and organizational security measures **For processors:** - Name and contact details of the processor(s) and of each controller on behalf of which the processor is acting, and, where applicable, the representative and data protection officer - Categories of processing carried out on behalf of each controller - Where applicable, transfers of personal data to third countries or international organizations - Where possible, a general description of technical and organizational security measures ## Exemptions Enterprises or organizations with fewer than 250 employees are exempt from the obligation to maintain a register, unless: - Processing is likely to result in a risk to the rights and freedoms of data subjects - Processing is not occasional - Processing includes special categories of data or personal data relating to criminal convictions and offences

Currently, Article 30 requires data controllers and their processors to maintain a register of processing activities, except for companies with fewer than 250 employees, provided that:

• The processing is occasional
• It does not involve sensitive data (Art. 9) or judicial data (Art. 10)
• It does not present any risk to the rights and freedoms of data subjects

The register must detail: the purposes of processing, the categories of data subjects, security measures, retention periods, recipients, transfers outside the EU, etc.

With the new proposal, the lightening of the GDPR would result in a simplification of documentation obligations for a greater number of companies.

# A simplification that divides

The proposal has sparked reactions. While some see it as a breath of modernization, others fear a weakening of data protection.

For Politico, it represents a "crack" in the GDPR, which had until now been considered untouchable. The CCIA (American tech lobby) believes, on the contrary, that the measure is too timid and will not solve anything for European competitiveness. NOYB (Max Schrems' association) denounces an added complexity: more steps, more delays, more imbalances between companies and users.

Criticisms that show just how much the GDPR remains a sensitive and highly political subject.

Our analysis at Data Comply One (formerly Mission RGPD)

At Data Comply One (formerly Mission RGPD), we have been supporting over 1,000 SMEs, mid-sized companies, associations and local authorities in their GDPR compliance for 6 years. And our observation is simple:

What creates obstacles is not the GDPR itself, but the fact that it is too often misunderstood and misapplied. The processing register, if it remains documentary, static, isolated and administrative, has no real value.

The register, for example, is not an end in itself. It does not protect data, does not respond to a rights request, does not reduce risks. It is a tool. But only if it is connected to operations.

Since 2019, we have digitised, automated and redesigned the register so that it becomes a real management tool — not a file forgotten in a SharePoint folder.

📡 With our SaaS platform, the register is:

• ✔️ Digital and collaborative, to involve business managers
• ✔️ Up to date, to reflect the reality on the ground regarding personal data
• ✔️ Automated, to save precious time
• ✔️ Connected to operations, to concretely manage risks

It allows you to:

• ✔️ Identify critical processing activities
• ✔️ Detect risks and non-compliant subcontractors
• ✔️ Structure responsibilities and evidence of compliance
• ✔️ Serenely prepare a response to an audit, a client or a tender

🛠 Because what really matters for an SME or a mid-sized company is not paperwork…

It is being able, on a daily basis, to:

• Protect the data of its customers and employees
• Avoid incidents, data breaches and crisis management
• Not make mistakes in a DPA that is legally binding
• Reassure a client before signing a contract
• Respond within deadlines to a rights request from a prospect to protect its reputation
• Quickly prove its compliance during due diligence or an audit (M&A, fundraising, cyber certification, CSR...)

This is exactly what we do with our platform, our Coach DPO experts and outsourced DPOs, by supporting over 1,000 companies on a daily basis.

This is our vision at Data Comply One (formerly Mission RGPD): a "Service as a Software" SaaS platform designed to help SMEs and mid-sized companies manage their regulatory challenges, without spending hours on it, and serving their business performance and growth.

Conclusion: Simplify yes, but without compromising

The GDPR update is underway. Simplifying the GDPR is necessary so that companies can focus on what matters: protecting data effectively and without unnecessary complexity. Less paperwork to better focus on personal data protection.

But be careful not to confuse streamlining the GDPR with abandoning its foundations. Because behind every unchecked box, there is an uncontrolled risk. So, to be continued…

Take stock for free with our online GDPR Diagnosis: in just a few minutes, identify what is truly in place at your organization, what remains to be done, and how to turn compliance into a performance driver.