A small enterprise may fall under a records-of-processing exemption for certain activities, yet it still runs large-scale health-data analytics with high residual risk and no risk analysis. What is the sound accountability approach?
Select an answer to reveal the explanation.
Short Explanation
Small shop or not, if you're running a high-voltage experiment, you still need safety gear. Size-based break on some paperwork doesn't mean high-risk health analytics get a free pass on DPIAs and risk thinking.
Full Explanation
Even where a small enterprise may benefit from limited records-of-processing relief, running large-scale health-data analytics with high residual risk and no risk analysis still demands careful measures, including a DPIA when criteria are met. Size-based formalities do not create a civic free pass to process sensitive health data at scale without risk thinking—patients and employees remain exposed. Ignoring all GDPR risk tools forever once headcount is below fifty fails by turning a narrow exemption logic into a blanket immunity myth. Transferring all health data to a US blog host to avoid European accountability fails as unlawful dumping and usually worsens transfer and security risk. Treating high-risk special-category analytics as anonymous by renaming the database fails by cosmetic relabelling that does not achieve anonymisation. Exam caveat: Article 30 exemptions are conditional and limited; they never cancel Article 5 principles, Article 9 conditions, security duties, or Article 35 DPIA triggers for likely high-risk processing. Operational check: confirm whether any RoPA exemption truly applies, run a DPIA on the health analytics, document Article 9 conditions and TOMs, minimise data, and halt expansion until residual risk is managed and recorded.