Much less than 250 employees but its details-processing impacts the legal rights and freedoms of information subjects, is just not occasional, or includes specified forms of sensitive individual facts. The RSI security weblog breaks down the steps in some detail, but the method in essence goes similar to this: Lots https://livewebnews.info/nathan-labs-advisory-shaping-robust-cyber-security-policies-in-the-usa/