EU Parliament Committees adopt GDPR small business simplification rules

Three European Parliament committees have voted to adopt proposals defining small mid-cap enterprises (SMCs) to help businesses navigate growth more smoothly. The rules aim to prevent cliff-edge scenarios in which regulatory obligations under the EU General Data Protection Regulation (GDPR) increase abruptly as a company expands beyond the SME category.

MEPs have proposed defining SMCs as organisations with fewer than 1,000 employees and either an annual turnover of up to €200 million or total assets of up to €172 million. These amounts exceed the European Commission's initial recommendations of 750 employees, €150 million in turnover and €129 million in total assets. 

Parliament is keen to ensure that support for smaller businesses remains by following a "think small" first principle. To maintain relevance, the committees have also suggested that these financial and workforce thresholds be reviewed formally every five years.

Training Announcement: Freevacy offers a range of independent data protection qualifications from IAPP and BCS. Our certified courses are available at foundation and practitioner levels and cover multiple legal jurisdictions, data protection operations management, and the implementation of complex privacy solutions in technical environments. Find out more.