Areas /GDPR and personal data
The supplier asks which data processing agreement applies. There are three versions.
One in the contract folder, one in an email from the spring, one somebody rewrote and never sent.
-
Record of processing activities
GDPR Article 30
-
Data processing agreement
GDPR Article 28(3)
-
Routine for a personal data breach
GDPR Articles 33 and 34
-
Routine for retention and access
GDPR Article 32
In plain terms: every employer processes personal data about its own staff, which puts you squarely inside the GDPR.
You have to be able to show what you process and why, hold written agreements with anyone handling data on your behalf, have taken reasonable security measures, and be able to act within seventy-two hours if something leaks.
The exemption for companies under 250 employees sounds like relief and is not. It requires the processing to be occasional, low risk and free of special category data, all at the same time. If you keep personnel files you meet none of the three.
Do any of these sound familiar?
- Which version of your data processing agreement applies today?
- Where is it written who may see the personnel files?
- What do you do in the first hours if personal data goes astray?
Examples of the documents you get
| DOCUMENT | STATUTE |
|---|---|
| Record of processing activities | GDPR Article 30 |
| Data processing agreement | GDPR Article 28(3) |
| Routine for a personal data breach | GDPR Articles 33 and 34 |
| Routine for retention and access | GDPR Article 32 |
Do we need a data protection officer?
Rarely, for an ordinary small company. You still have to know what personal data you hold, why you hold it and for how long.
Olle Nordberg, business development and co-founder, answers the question we get most. You only need a data protection officer if you are a public authority, carry out large-scale monitoring, or process special category data at scale. A typical company this size needs none.
Checked against GDPR Articles 28, 30, 32, 33 and 34 · Updated 10 October 2026
With Ordning
You know where the documents are, that they are the current version when created, and that they cover what you need.
With Kontroll
You know they hold together every day. Change an agreement and you see what it means for the record.