Planned data protection relief for medium-sized businesses in the European Union

On May 21, 2025, the European Commission presented the Omnibus IV Simplification package – a proposal to reduce bureaucracy and modernize the EU Single Market. It includes extensive measures to provide specific relief for medium-sized businesses through the newly defined “Small Mid-Cap” (SMC) company category.

New EU definition for small mid-caps (SMC)

The Commission recommends introducing a new, expanded definition of small mid-cap (SMC) companies. The aim is to mitigate the “cliff edge” effect, in which companies with 250 or more employees are suddenly confronted with significantly higher EU obligations. The SMC category is intended to capture companies that have exceeded the SME threshold but are still significantly smaller than large corporations.

In the future, companies will be considered SMC if they:

• employ fewer than 750 people and
• either have an annual net turnover of up to 150 million euros OR a balance sheet total of up to 129 million euros.

Adjustments to the GDPR

• The previous exception (Art. 30 Para. 5) to the obligation to keep a register of processing activities will be extended from companies with fewer than 250 employees to companies with fewer than 750 employees.
• In addition, companies with fewer than 750 employees will now only have to maintain this register for processing activities that are likely to pose a high risk to the rights and freedoms of the data subjects.
• The processing of sensitive personal data that is necessary for the fulfillment of labor or social law obligations (Art. 9 Para. 2b) should not automatically result in the obligation to maintain a processing register.
• In the future, the specific needs of SMC should also be taken into account when creating codes of conduct (Art. 40) and certification mechanisms (Art. 42) within the framework of the GDPR.