A second rule gets confused with the officer rule. Article 30 requires every controller and processor to keep records of processing activities. That duty lifts only for an organisation employing fewer than 250 persons. It lifts only if three further conditions also hold. The processing must not be likely to endanger data subjects' rights or freedoms. It must be occasional. It must not cover Article 9 special-category data or Article 10 criminal-offence data. Fail any one condition and the records duty applies.
The 250-person figure belongs to the records exemption only. It is not a free pass for the whole regulation. It is not the test for the officer either.
How Much Does a GDPR Compliance Failure Cost?
Article 83 of the GDPR sets two tiers of administrative fine. The lower tier caps a penalty at EUR 10,000,000 or 2% of total worldwide annual turnover. That is the higher of the two amounts. The higher tier caps the penalty at EUR 20,000,000 or 4% of total worldwide annual turnover. Again, that is the higher of the two amounts. The UK sets its own figure. UK GDPR Article 157 caps the penalty notice at GBP 17,500,000 or 4% of worldwide annual turnover. The higher amount applies. The [Article 157 text on legislation.gov.uk](https://www.legislation.gov.uk/eur/2016/679/article/157) states it directly.
The rule that takes the higher of the two has a consequence that is easy to miss. Below a certain turnover, the fixed sum is what you actually face. The EU switch sits at EUR 500,000,000 of worldwide annual turnover. The inputs are EUR 10,000,000 divided by 2% and EUR 20,000,000 divided by 4%. Both give EUR 500,000,000. The UK switch sits at GBP 437.5 million of worldwide annual turnover. That figure is GBP 17,500,000 divided by 4%.
Work one example. A company with EUR 300,000,000 of worldwide annual turnover faces a maximum EU fine of EUR 20,000,000. Four percent of EUR 300,000,000 is EUR 12,000,000, and the fixed sum is higher.
The [GDPR compliance cost for SaaS startups](/blog/gdpr-compliance-cost-saas-startup-2026) guide covers what a small team spends.
Which GDPR Compliance Requirements Have a Hard Deadline?
Two obligations run on fixed clocks. A personal data breach that is likely to risk the rights and freedoms of people must reach the supervisory authority. The limit is 72 hours from becoming aware of it. There is no duty to notify when the breach is unlikely to risk anyone. If you notify late, give reasons for the delay. A processor that becomes aware of a breach must inform the controller without undue delay.
The second clock is one month. Access, rectification, erasure and restriction requests are generally answered within one month of receipt. The deadline can be extended in set cases.
The rest of the GDPR compliance requirements are continuous work, not clock-driven. Every breach must be documented, notified or not. You record the facts, the effects and the remedial action.
The table below pairs each requirement with its trigger, its deadline and the evidence you keep.
| Requirement | Trigger or threshold | Deadline | Evidence to keep |
|---|
| Notify the supervisory authority of a personal data breach | Breach likely to risk the rights and freedoms of natural persons | 72 hours from awareness under Article 33(1); reasons required if later | Breach log with detection, assessment and notification timestamps |
| Answer a data subject rights request | Access, rectification, erasure or restriction request received | One month, extendable | Request log, identity check and the response sent |
| Conduct a DPIA | Processing likely to result in a high risk to data subjects | Before the processing starts | Signed DPIA with mitigations tracked |
| Appoint a DPO and publish contact details | Any of the three Article 37(1) cases | On appointment, with contact details published | Appointment record and published contact details |
A DPIA is a data protection impact assessment. You complete it before high-risk processing starts.
What Is Changing Under the Digital Omnibus?
The Digital Omnibus is a proposal, not a change you must plan around yet. On 11 February 2026 two EU bodies published Joint Opinion 2/2026 on it. They are the EDPB (European Data Protection Board) and the EDPS (European Data Protection Supervisor). The [joint opinion](https://www.edpb.europa.eu/news/digital-omnibus-edpb-and-edps-support-simplification-and-competitiveness-while-raising-key_en) supports several parts of the proposal. It welcomes a higher risk threshold for notifying a personal data breach. It welcomes a longer notification deadline. It welcomes common templates for breach reports and impact assessments. It also welcomes a new rule for biometric authentication.
The two authorities also give a warning. The proposed changes to the definition of personal data go beyond a technical amendment. They depart from case law of the Court of Justice of the European Union. The authorities oppose giving the Commission power to decide what stays personal data after pseudonymisation.
Plan for template-driven filing. Do not rebuild your compliance programme on the definition change until it becomes law.
What Are the Next Steps?
Work through these three checks in order.
- Scope test - note which Article 3 clause brings you in, or record that none does.
- Records and officer test - check the four Article 30 exemption conditions each year. Then check the three Article 37(1) cases against your main activities.
- Clock test - confirm a 72-hour breach path and a one-month rights path in your procedures.
Write these answers down this quarter. Review them when your products or customers change.
Photo: TheDigitalArtist, Pixabay Content License, via Pixabay (https://pixabay.com/photos/laptop-gdpr-privacy-protection-3233780/)
Fazlur Rahman
