Much less than 250 workforce but its data-processing impacts the legal rights and freedoms of information subjects, isn't occasional, or consists of particular kinds of delicate particular knowledge. Organizations have to conduct normal audits of privacy protection practices to prove compliance with GDPR. Records of all data that is held, https://webapplicationsecuritytestingusa.blogspot.com/