"Those companies with fewer than 250 employees are required to hold internal records of processing activities if the processing of data could risk an individual

"Those companies with fewer than 250 employees are required to hold internal records of processing activities if the processing of data could risk an individual's rights or freedoms, or if it pertains to criminal activity. For those with more than 250 employees, more detailed records need to be kept. These include the name and details of your organisation, the name of your assigned data protection officer, the reasons for processing the data, a description of the categories of data being processed, details on the recipients of the data, how long it will be retained, details on transfers outside of the EU, and an overview of the security measures your organisation has put in place." - [1] [1] https://www.itpro.co.uk/data-protection/29123/gdpr-for-small-businesses-what-it-means-for-you https://www.itpro.co.uk/data-protection/29123/gdpr-for-small...