Much less than 250 workforce but its details-processing impacts the legal rights and freedoms of information topics, is not really occasional, or incorporates certain sorts of sensitive particular knowledge. The RSI security blog breaks down the ways in a few detail, but the method in essence goes similar to this: https://blockchaindevelopmentservicesusa.blogspot.com/