To scope GDPR, decide whether the law reaches you, list every processing activity involving personal data, label your role in each (controller or processor), and map where data flows. The Article 30 record of processing is the natural scoping document, and the small organization exemption from it is narrow.
We fetched Article 30 on 18 October 2026. Our attempts to fetch Articles 2, 3 and 37 failed, so the description of territorial scope below comes from general knowledge of the regulation and needs checking against the text. This is not legal advice.
Does GDPR apply to you?
Territorial scope sits in Article 3. In general terms it reaches organizations established in the EU, and organizations elsewhere that offer goods or services to people in the EU or monitor their behavior there. Material scope (Article 2) covers processing of personal data by automated means or as part of a filing system. A non-EU company with EU customers, EU website visitors who are tracked, or EU employees should assume it is in scope and confirm with counsel.
What is a processing activity?
Anything you do with personal data for a purpose: running payroll, sending a newsletter, storing customer accounts, logging IP addresses, handling support tickets, scanning customer repositories that contain author names. Each is a row in your record.
How do you build the record?
Article 30 says controllers keep a written record, electronic form allowed, containing: contact details, purposes, categories of data subjects and personal data, recipients, transfers to third countries and their safeguards, and where possible erasure time limits and a general description of security measures. Processors keep a record of processing carried out for each controller, with their own contact details, the categories of processing, transfers and a general security description. Both must make the record available to the supervisory authority on request.
What about the exemption for small organizations?
Article 30 exempts organizations with fewer than 250 employees, but not if the processing is likely to risk people's rights and freedoms, is not occasional, or includes special category data or criminal conviction data. Regular processing such as payroll or customer accounts is not occasional, so most small companies end up keeping a record anyway.
Which roles do you hold?
Decide for each activity whether you decide the purposes and means (controller) or process on someone's instructions (processor). A software provider can be a processor for customer data and a controller for its own employee and marketing data. Roles drive contracts, records and notices.
What boundaries should you document?
- Systems that store or process personal data, including third party services.
- Data categories and whether any are special category.
- Countries where data is stored, accessed or supported from.
- Vendors acting as processors and the agreements with them.
- Teams and people with access.
- Retention and deletion rules.
Anything you exclude needs a written reason, such as no personal data held or fully anonymized.
What to do
- Decide with counsel whether Article 3 reaches you, and write the conclusion.
- List all processing activities by team, using interviews rather than guesses.
- Record role, purpose, data, recipients, transfers, retention and security for each.
- Check the Article 30 exemption honestly, and keep a record anyway if in doubt.
- Build a vendor list and identify where processor agreements are missing.
- Review the scope when you add a product, vendor or market.
Quick check
Do small companies skip the record of processing?
Only if they have fewer than 250 employees and none of the exceptions apply: risky processing, non-occasional processing, special category data or criminal conviction data. Regular processing usually breaks the exemption.
Can a company outside the EU be covered by GDPR?
In general yes, if it offers goods or services to people in the EU or monitors their behavior there. Confirm against Article 3 and with counsel.
How Safeguard helps automate this
Once the processing map exists, the safeguards behind it need continuing evidence. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, leaving time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability, which supports the security measures you describe in your records. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. Safeguard does not give legal advice or make you compliant. Book a call to see it.
Sources
- GDPR Article 30 text, gdpr-info.eu, fetched 18 October 2026
- Articles 2, 3 and 37: fetch failed on 18 October 2026, so statements are general and need checking
Last reviewed: 18 October 2026.
