Do I need a Data Protection Officer under the GDPR?

"Do we need a DPO?" is one of the first GDPR questions a growing company hits, and the answer is narrower than most people assume. The GDPR does not require every business to appoint a data protection officer. Article 37 sets three specific triggers, and if none of them fits you, appointing a DPO is a choice, not a legal duty. Getting the answer right matters, because a DPO carries real independence and reporting obligations once you name one.

When is a DPO mandatory?

Article 37(1) lists three cases where a controller or processor must designate a DPO. First, where the processing is carried out by a public authority or body, except for courts acting in their judicial capacity. Second, where your core activities consist of processing that, by its nature, scope, or purposes, requires regular and systematic monitoring of data subjects on a large scale. Third, where your core activities consist of large-scale processing of special category data under Article 9 or personal data about criminal convictions and offences under Article 10. If you fall into any one of these, the appointment is not optional.

What do "core activities" and "large scale" mean?

The trigger turns on core activities, meaning the processing that is essential to what you do, not support functions like running payroll or internal IT. A hospital's core activity is delivering care, which involves health data; a security firm's core activity may be surveillance. The GDPR sets no fixed number for "large scale," so you weigh the volume of data, the number of people affected, the duration, and the geographic reach. Guidance endorsed by the European Data Protection Board points to factors rather than thresholds, so a business assesses its own scale honestly and records the reasoning.

Who can be a DPO, and what must they do?

Under Article 37(5), the DPO is chosen on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices. Article 37(6) allows the DPO to be a member of your staff or to work under a service contract, so outsourcing is permitted, and a group of undertakings may share a single DPO who is easily accessible from each establishment. Once appointed, Article 37(7) requires you to publish the DPO's contact details and communicate them to your supervisory authority. The DPO then supports the wider governance duties, including your record of processing activities and any data protection impact assessment.

What if a DPO is optional?

If none of the Article 37(1) triggers applies, you are not required to appoint a DPO, but two things still matter. Member State law can impose its own DPO requirement beyond the GDPR minimum, so check the countries you operate in. And appointing a DPO voluntarily is allowed, but once you do, the same Article 38 and 39 rules on independence and tasks apply, so it is a real commitment rather than a title. Record your decision either way, so you can show your reasoning if a regulator asks.

Next step

If you are unsure whether monitoring or special category processing tips you into a mandatory DPO, the free 2-minute Obligation Scan checks whether the GDPR applies to you and flags whether an Article 37 trigger is likely, so you appoint a DPO when the law requires it and not by guesswork. The GDPR compliance hub lays out the governance duties a DPO would oversee.