A controller that is a small enterprise may skip the section 39 record except the log of rejected requests and objections, if it is a small or medium enterprise under SME law, a community enterprise or network, a social enterprise or group, a cooperative, cooperative assembly or farmers' group, a foundation, association, religious or non-profit organisation, a condominium or housing-estate juristic person (added in 2024), a household or similar business, or a business run by an individual (added in 2024), and is not required to appoint a DPO. The exemption does not apply where processing is likely to risk data subjects' rights, is not occasional, or involves section 26 data. The 2024 notification removed the 2022 carve-out that excluded service providers obliged to keep computer traffic data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.