Only those companies whose data processing operations carry significant risks, such as huge amounts of sensitive or personal data, are required by the Bill to maintain thorough records.