A friend of mine quoted the following from an article written here (bullet #9): https://government.diginomica.com/2018/01/22/gdpr-compliance-here-are-the-14... *"Smaller firms – those defined as having 250 employees or less – do not have to comply with all GDPR rules as standard. If your organisation falls into this band, there’s no need to have documentation of why personal data is being collected and processed, the information you’re storing or how long for. Smaller firms are not required to maintain a record of processing activities unless this carries a risk to the rights and freedoms of data subjects, it is a regular occurrence, or it relates to certain data like criminal convictions and offences."* The question: Is this statement true or false. If false what 's the real thing? Thanks to whomever answers this. -ed