Undertakings and other private organisations employing fewer than 250 employees on 1 January of any year and natural persons are exempt from the obligation to keep a record of processing activities unless any one of the following requirements is met:

• a. a large volume of sensitive personal data is being processed;
• b. high-risk profiling is being carried out.