For the person who has to sign, GDPR data storage requirements is a phrase that gets searched by two people: the one who wants a definition for a memo and the one who has to sign an attestation about it next quarter. This page is written for the second. For a business processing personal data of people in the EU, GDPR data storage requirements comes down to a record and a set of figures: the record is the record of processing, the processor agreements, the lawful bases and the requests handled, kept with an owner, a date and a status; the figures are the evidence load that record puts on its reviewers, the days an audit of it takes, the gaps an audit will find and what they cost, the incidents and cases it produces, and the training it requires. The sections below explain GDPR data storage requirements in those terms, say what it is not, and show where the free sheets on this site work each figure from the program's own numbers with no account.
What GDPR data storage requirements means in practice
For a business processing personal data of people in the EU, it means being able to show, for each obligation, which control satisfies it, what evidence proves the control operated, who reviewed the evidence and who attested to the result. The record is the record of processing, the processor agreements, the lawful bases and the requests handled. The regulator's own material, linked below, says what the obligations are; this site publishes none of that and no legal advice. What it publishes is the arithmetic: the obligations register sheet turns the count of obligations, controls and evidence items into reviewer hours and the months to a full attestation.
Requirements, kept as a register
Requirements are the regulator's list; the register is the program's answer to it, obligation by obligation, with a control and evidence under each. The obligations register sheet on this site turns the list into reviewer hours and the months to a full attestation, which is how a requirement becomes a schedule.
The gdpr data map Article 30 asks for, and who is exempt from it
Article 30 calls it a record of processing activities, and the working artefact everyone builds for it is a data map: per processing activity, the purpose, the categories of data subject and data, the recipients including any outside the region, the retention period where one can be stated, and a general description of the security measures. Article 30(5) then exempts an organization employing fewer than 250 persons, but only if the processing is occasional, is not likely to risk data subjects' rights and freedoms, and includes no special category data or criminal offence data. Most small businesses fail at least one of those three, so the exemption is narrower in practice than its headcount reads.
What GDPR data storage requirements is not
It is not a certificate, a piece of software or a consultant's memo, although all three are sold under the name. It is a record and the figures that follow from it, kept by the business that owes the obligations. The guide this page supports covers scoping regulatory compliance consulting from the register, the help a small business buys around that record. Attestvio Pro keeps the record at one flat price; the sheets are free with no account.
The figures behind GDPR data storage requirements
Evidence items and reviewer hours; audit samples, days and coverage; expected gaps, remediation hours and cost; incident hours; case backlog months; training seats outstanding. Each is a free sheet on this site and each computes from the program's own inputs. For GDPR the sheet to start with is the GDPR data-mapping sheet, which works the figure a business processing personal data of people in the EU is examined on first. A program that knows those numbers has stopped estimating its own compliance.
Gdpr for small business: the fewer than 250 persons carve out and its three exceptions
The regulation does scale, and it scales less than small businesses hope. There is no turnover or headcount threshold for the principles, the lawful basis, the subject rights or breach notification: those apply to a two person company processing one mailing list. What the headcount reaches is the record keeping duty in Article 30, and even there the carve out falls away if processing is regular rather than occasional, if it could risk people's rights, or if it touches health, biometric, political or similar data. A payroll bureau or a clinic is inside all three exceptions, so the honest planning assumption for a small regulated business is that the record is owed.
Gdpr clinical trials retention, and the twenty five year file
This is where the storage limitation principle meets a rule that says keep it. Under the EU clinical trials regime the sponsor and the investigator have to archive the clinical trial master file for at least twenty five years after the end of the trial unless other law requires longer, while subjects' medical files are archived under national law instead. So a sponsor cannot answer a data subject's erasure request about trial records by deleting them, and its retention schedule has to carry the trial file as a named exception with the legal ground written beside it. The practical consequence for the register is that the exception has to be recorded per data category rather than per system, because the same database holds records with very different clocks on them.
Questions people ask about GDPR data storage requirements
What is GDPR data storage requirements?
For a business processing personal data of people in the EU: keeping the record of processing, the processor agreements, the lawful bases and the requests handled as a record with an owner, a date and a status, and being able to show for each obligation the control, the evidence and the attestation. The regulator's own material, linked below, defines the obligations; the free sheets on this site work the arithmetic.
Who is responsible for GDPR data storage requirements in a small business?
The compliance officer, or the owner wearing that hat, who signs the attestation. The sheets on this site are written for that person and need no account.
Does Attestvio make a business compliant with GDPR?
No. The business meets the obligations; Attestvio keeps the record and works the figures, and publishes no rule and no advice. Counsel and the regulator's own material say what the obligations are.
How do gdpr and clinical trials rules fit together?
As two separate instruments a sponsor needs both of. The trial rules require informed consent to take part, and that consent is about the medical procedure rather than about the processing, so it is not automatically the lawful basis the data protection rules ask for. Health data is a special category, which needs both a lawful basis and a separate condition for processing it, and the retention rule above overrides the usual storage limits. A US sponsor running a trial with participants in the EU is inside all of this whether or not it has an establishment there.