Only organizations engaged in "professional or commercial activity" with more than 250 employees are required to be compliant with GDPR. However, smaller organizations with 250 or fewer employees are not totally exempted from the GDPR. They are instead not bound with obligations on record-keeping.