A small enterprise may fall under a records-of-processing exemption for certain activities, yet it still runs large-scale health-data analytics with high residual risk and no risk analysis. What is the sound accountability approach?
Select an answer to reveal the explanation.
Short Explanation
Small shop or not, if you're running a high-voltage experiment, you still need safety gear. Size-based break on some paperwork doesn't mean high-risk health analytics get a free pass on DPIAs and risk thinking.
Full Explanation
Certain Art. 30 exemptions can ease record-keeping for smaller organisations in limited situations, but they do not cancel risk-based duties. Large-scale special-category processing that is likely high risk still calls for appropriate accountability measures, including a DPIA when GDPR criteria are met. Renaming data or offshore dumping does not remove those obligations.