[NA-Discuss] Question about GDRP

[Eduardo Diaz]

A friend of mine quoted the following from an article written here (bullet
#9):
https://government.diginomica.com/2018/01/22/gdpr-compliance-here-are-the-14-things-you-actually-need-to-do/


*"Smaller firms – those defined as having 250 employees or less – do not
have to comply with all GDPR rules as standard. If your organisation falls
into this band, there’s no need to have documentation of why personal data
is being collected and processed, the information you’re storing or how
long for. Smaller firms are not required to maintain a record of processing
activities unless this carries a risk to the rights and freedoms of data
subjects, it is a regular occurrence, or it relates to certain data like
criminal convictions and offences."*

The question: Is this statement true or false. If false what 's the real
thing?

Thanks to whomever answers this.

-ed
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://atlarge-lists.icann.org/pipermail/na-discuss/attachments/20180430/f8efecaf/attachment.html>