GDPR Article 37 requires a data protection officer in three cases: the processing is done by a public authority, your core activities involve regular and systematic monitoring of people on a large scale, or your core activities involve large scale processing of special category or criminal offence data. Otherwise appointing one is voluntary unless national law says so.
The three triggers
- Public authority or body, other than courts acting in a judicial capacity.
- Core activities involving regular, systematic monitoring on a large scale. Think of a service whose main business is tracking user behaviour.
- Core activities involving large scale processing of special categories (such as health data) or data on criminal convictions and offences.
"Core activities" and "large scale" are not defined in the article text. The European Data Protection Board has published guidance on both, which you should read before deciding. This post does not summarise it.
Working through your own case
Ask whether the processing is the heart of what you sell or incidental to it. A payroll system for your own staff is ancillary. A health app whose product is processing health data is closer to core. Then ask about scale: number of people, volume of data, duration and geographic spread. Write the analysis down and date it. The record shows you considered the question, which matters even if you conclude that no DPO is required.
Voluntary and group appointments
Outside the mandatory cases a DPO may be designated voluntarily, or must be where EU or Member State law requires. A group of companies may appoint a single DPO, provided that person is easily accessible from each establishment. Public bodies may share one.
Think about the title before using it. Whether a voluntary appointee carries the same duties as a mandatory one is a question for your counsel and your national authority, and the article text above does not answer it.
Publishing the details
The controller or processor must publish the DPO's contact details and notify them to the supervisory authority. Put a monitored mailbox on your privacy notice.
Where a DPO fits in the program
The DPO's advice must be sought during a data protection impact assessment, and the contact name belongs in a breach notice to the regulator. See the posts on DPIA checklists and breach notification.
Quick check
Does a startup with ten staff need a DPO?
Size alone does not decide it. The three triggers do, so a small health data company may need one.
Can the DPO be an outside consultant?
The article text above does not address this. Check the EDPB guidance and your national authority.
Sources
Last reviewed: 19 October 2026.
