The EU Commission is striving towards simplifying the legislative framework for business and has proposed, as part of its package of Small and Medium Enterprise (SME) reliefs, some relatively modest modifications. In the data protection area these are to do with GDPR Records of Processing Operations – ROPAs. It is proposed(1) that the derogation under Article 30(5) GDPR would be modified so that the record-keeping obligation would not apply to an enterprise or organisation employing fewer than 750 persons (unless the processing it carries out is likely to result in a high risk to data subjects’ rights and freedoms, within the meaning of Article 35 GDPR). Currently, such derogation only applies to enterprises and organisations that have up to 250 employees.