privacy compliance

GDPR Article 30 requires controllers and processors to keep a written record of processing activities. The under-250-employee exemption rarely applies in practice