When Does Your Company Really Need a Data Protection Officer?

Headcount is the wrong question

GDPR does not decide whether you need a Data Protection Officer by counting employees, clients, or deals. It asks what your core business does with personal data. A 15-person company whose core product regularly and systematically tracks identifiable users at scale can be required to appoint a DPO. A 400-person manufacturer processing mainly employee and B2B contact data may not need one under GDPR's core tests, although national law, such as Germany's, can change the answer.

Most management teams meet this question at an inconvenient moment: an enterprise security questionnaire asking “who is your DPO,” an investor's due diligence list, or a regulator's first letter. At that stage the answer is either documented or, worse, improvised.

This piece sets out when GDPR requires the appointment, where national law goes further, who can actually hold the role, and how two other regimes a growing company may meet handle the same question.

The three GDPR triggers

GDPR (Article 37(1)) requires a “controller” or “processor” to designate a DPO in three situations. Any one of them is enough.

1. Processing of personal data is carried out by a public authority or body, other than courts acting in their judicial capacity.
2. Your core activities consist of processing operations which, by their nature, scope, or purposes, require regular and systematic monitoring of data subjects on a large scale.
3. Your core activities consist of processing on a large scale of special categories of data under Article 9, or of criminal conviction and offence data under Article 10.

For private companies, the second and third triggers decide almost every case. Each rests on phrases the Regulation does not define: core activities, large scale, and regular and systematic monitoring. That is where most companies either over-appoint out of caution or, more often, under-appoint because nobody looked closely.

Once an obligation applies, GDPR Article 37(7) adds two formalities that are regularly missed: publish the DPO's contact details, and communicate them to the supervisory authority.

Three questions behind the legal test

Regulators test three phrases (GDPR, Article 37). Each comes down to a plain business question:

Is it what the product does, or back-office admin? Regulators call this your “core activities.” Payroll, HR files, and IT support almost never count. What counts is the data work the business cannot run without. If your product’s value comes from analysing what identifiable users do, that analysis is core, even though you sell software and not data.

Is it big? There is no magic number. Regulators look at how many people are involved, how much and what kind of data, for how long, and across how many countries. A bank’s customer base is big. One doctor’s patient list is not, but both fall under GDPR.

Is the tracking ongoing and built in? “Regular and systematic monitoring” means tracking or collecting that runs continuously as part of how the system works, not a one-off exercise. Behavioural advertising, user profiling, credit or fraud scoring, location tracking, wearables, and connected devices are common examples.

The trap for scaling companies is that nobody inside thinks of the business as a monitoring business. Product analytics tied to user accounts, an AI feature that builds a profile of each user, workforce analytics, or a health or fintech feature added to an ordinary platform can each change the answer. Regulators judge what the system does, not how the company describes itself.

Where national law goes further

GDPR allows Union or Member State law to require a DPO in additional cases. Germany is the example that most often catches growing companies. Under section 38 of the Federal Data Protection Act, a controller or processor must appoint a DPO if it regularly employs at least 20 people constantly engaged in automated processing of personal data. The obligation applies regardless of headcount if the company carries out processing that requires a DPIA under Article 35, or processes personal data commercially for transfer or for market or opinion research.

In practice, a company with an establishment in Germany can cross the threshold surprisingly fast if at least 20 people across functions such as sales, support, HR, and finance are routinely engaged in automated processing of personal data. Every EU establishment needs its own check against local law.

The United Kingdom kept the same test. The Data (Use and Access) Act 2025 dropped the earlier proposal to replace the DPO with a “senior responsible individual,” so UK GDPR Article 37 still requires a DPO in the same cases.

Processors, groups, and the EU representative

Processors carry their own obligation. A processor must assess its own processing operations, rather than looking only at each customer in isolation. A B2B platform processing personal data at scale across hundreds of customers may need a DPO even where individual customers do not.

Groups can share one. Article 37(2) allows a group of undertakings to appoint a single DPO, provided that person is easily accessible from each establishment. Accessibility is a real test, covering language, availability, and time, not a line in the group structure chart.

A DPO is not an EU representative. A company established outside the EU that offers goods or services to people in the EU, or monitors their behaviour, generally needs an EU representative under GDPR Article 27. The representative is the company's point of contact in the EU for regulators and individuals. A DPO is an independent internal adviser and monitor. A company can need one, both, or neither.

The two roles should not sit with the same person for the same company. EDPB Guidelines 3/2018 on territorial scope treat acting as representative as incompatible with acting as external DPO for that controller, because the representative takes instructions from the company and the DPO must not.

Who can actually hold the role

Under GDPR, professional qualities and expert knowledge of data protection law and practice are required. Article 37(6) allows the DPO to be a staff member or an external provider under a service contract. Article 38 then sets the conditions that make the appointment real:

• involvement in all data protection issues, properly and in good time;
• resources, access, and training needed to do the job;
• no instructions on how the DPO performs the tasks;
• no dismissal or penalty for performing them;
• a direct reporting line to the highest level of management.

The DPO’s tasks are advisory and supervisory: inform and advise, monitor compliance including training and audits, advise on DPIAs, cooperate with the supervisory authority, and act as its contact point. The DPO is not personally liable for the company's non-compliance. The controller or processor is.

Conflicts are where appointments fail. The DPO may hold other roles only if they do not create a conflict of interest. The Court of Justice confirmed in February 2023 (X-FAB, C-453/21) that a DPO cannot be given tasks that lead them to determine the purposes and means of processing, and that the assessment is made case by case. In Leistritz (C-534/20, June 2022) it held that Member States may give DPOs stronger protection against dismissal, as Germany does. The Belgian authority fined Proximus EUR 50,000 in 2020 because its DPO also headed compliance, risk, and audit.

For a scaling company, the practical consequence is uncomfortable. The obvious internal candidates, the CTO, the COO, the head of IT, or a general counsel who also sets data policy, are often among the people whose decisions the DPO is meant to review. Appointing one of them is marking your own homework, and regulators read it that way. The French authority adds a narrower point for lawyers: a lawyer can act as external DPO, but should not also represent that organisation in litigation on data protection matters.

A newer mandate built on the same model

Companies that process personal data under Israeli law now face a mandatory appointment of their own. Amendment 13 to the Privacy Protection Law, in force since 14 August 2025, introduced a Privacy Protection Officer. In its opinion dated 14 July 2026 and published later that month, the Privacy Protection Authority set out how it reads the obligation and stated that it will apply that reading in enforcement, including monetary sanctions.

The triggers track GDPR Article 37 closely: public bodies and those holding their databases, data-trading businesses with data on more than 10,000 people, main activities involving regular and systematic monitoring at significant scale, and main activities involving significant-scale processing of highly sensitive data.

Three points go further than most EU readers would expect. Scale for a service provider is assessed across all its clients, and a vendor that only hosts a public body's data is caught. The officer needs deep knowledge of Israeli privacy law, so GDPR expertise alone does not meet the requirement. The opinion also names the CTO, the head of information systems, and the marketing, customer, and finance heads as typically conflicted.

The officer may be external, but must be an individual reporting to the CEO or a direct report of the CEO. An EU DPO does not automatically cover this obligation. One person can hold both roles only if they meet both knowledge standards and can genuinely serve under both regimes at once.

The United States: no DPO, but named accountability

No federal law and none of the roughly 20 state comprehensive privacy laws require a DPO. That does not mean nobody has to own the function. US law assigns it to named individuals and executives, sector by sector:

For many growth-stage technology companies with material California exposure, the California regime is the most likely of these frameworks to become relevant. Selling or sharing personal information, processing sensitive personal information, and using automated decision-making technology for significant decisions can each trigger a documented risk assessment. The regulatory submission must be made by a member of executive management, who attests under penalty of perjury that the assessments were conducted and that the information submitted is true and correct. Someone has to be able to stand behind that attestation.

The skill set overlaps heavily with the DPO's. The structure does not: the US model puts a named executive on the hook, while the GDPR model puts an independent adviser beside management.

When you are not required to appoint

If the analysis says no, write it down. Document the internal assessment of whether a DPO is required, as a regulator or an enterprise customer asking the question later will expect to see it. An undocumented “no” reads the same as never having asked.

If you appoint someone voluntarily and call the person a DPO, Articles 37 to 39 apply in full, including independence, reporting line, and protection from dismissal. Some companies therefore give a non-statutory privacy lead a different title. That is legitimate, provided nobody then describes that person externally as your DPO.

The commercial case for appointing without a legal obligation is usually stronger than the legal one. Even where appointment is voluntary, enterprise customers and investors may ask who owns privacy governance and how that person is positioned and whether they are appropriately qualified. A credible answer can matter commercially even when Article 37 does not require the title. The EU guidance and the July 2026 opinion discussed above both encourage voluntary appointment.

A working test for management teams

Seven questions settle most cases. A yes to any of the first six means the company should document the analysis rather than assume the answer.

1. Does the product value depend on tracking, profiling, scoring, or locating identifiable people?
2. Do we process health, biometric, genetic, or other special-category data, or criminal records data, as part of what we sell rather than only for HR?
3. Are we a processor? If so, what is the total across all customers, not per customer?
4. Do we have an establishment in Germany with 20 or more people routinely working with personal data, or any processing that needs a DPIA?
5. Do we host or process data for public-sector customers?
6. Do we process personal data under Israel’s Privacy Protection Law, which carries its own mandate?
7. Who internally would take the role, and would that person be reviewing their own decisions?

The seventh question is the one that turns a legal answer into an operating decision. It is also where most first appointments go wrong.

If you are sitting on a product that answers yes to one of the first six, with no documented DPO analysis, and want a 30-minute look at it, book a call below.

Internal or external

A full-time internal DPO makes sense once the data protection workload justifies a full role and the organisation can place that person outside the decisions they review. Where the workload does not justify a full-time specialist, an external DPO can be the cleaner structure. Independence is built into the contract rather than negotiated against a reporting line, there is no conflict with an existing management role, and the cost follows the actual workload.

An external appointment only works if it is treated as a real one: a written appointment, a defined time allocation, access to the people and systems involved, a direct line to the CEO or board, published contact details, and notification to the lead supervisory authority. A name on a privacy policy with no workplan behind it is not an appointment. It is a liability with a job title.

Companies usually reach this question through expansion into a new market, an enterprise procurement review, investor diligence, a new product feature that touches sensitive data, or a governance gap someone has finally named. That is the point where I work with them: whether the appointment is legally required, whether the proposed appointee is conflicted, and what operating structure will hold up. Where an external appointment is the right structure, I can serve as external DPO under GDPR and UK GDPR, coordinating with parallel obligations where the business is subject to them.

Where a company also needs an EU representative under Article 27, the two roles should sit with different people. I will say so at the outset rather than take both.

Related reading

• Privacy Enforcement and Operational Compliance
• The US Privacy Minefield
• GDPR EU Representative (Article 27)
• Privacy Governance and DPO Support

Sources

• Regulation (EU) 2016/679, Articles 37 to 39; Article 29 Working Party, Guidelines on Data Protection Officers, WP243 rev.01, endorsed by the EDPB.
• EDPB, Guidelines 3/2018 on the territorial scope of the GDPR.
• Bundesdatenschutzgesetz, section 38.
• Stephenson Harwood, Data (Use and Access) Act 2025 compared with the DPDI Bill.
• Privacy Protection Authority, opinion on the appointment of a privacy protection officer under Amendment 13, dated 14 July 2026.
• California Privacy Protection Agency, announcement of final regulations on cybersecurity audits, risk assessments, and ADMT, 23 September 2025.
• CJEU, C-453/21 X-FAB Dresden (9 February 2023); C-534/20 Leistritz (22 June 2022).