You do not need a Data Protection Officer simply because you sell software or handle personal data. The decision depends on your processing activities, whether you are a public authority and any additional applicable law. A small company can need a DPO; a large private company is not automatically exempt or automatically required to appoint one. GDPR, Article 37.
| Situation | What it means |
|---|---|
| Public authority or body | A DPO is generally required, except for courts acting in their judicial capacity. |
| Core activities require regular and systematic monitoring of people on a large scale | A DPO is required under Article 37. |
| Core activities involve large-scale processing of Article 9 special-category data or Article 10 criminal-conviction and offence data | A DPO is required under Article 37. |
| Additional applicable law requires appointment | Check that requirement separately, including relevant EU national law. |
| A customer asks for a DPO | A commercial question, not a new statutory trigger. |
| None of the applicable appointment requirements is met | Document the assessment; consider whether voluntary appointment would help. |
Atoro is an Irish AI governance and cyber compliance consultancy, and the first in Europe to be certified against ISO 42001. Our outsourced DPO service supports privacy oversight, while our GDPR implementation work helps teams put the underlying programme in place.
The legal test, plainly
Article 37 applies to controllers and processors. Assess what your organisation actually does with personal data, not just its size or job titles.
The three main appointment conditions are set out in the table above; Article 37(4) also recognises additional EU or Member State requirements. GDPR.
Core activities are activities central to delivering your business. Maintaining your own employee records is normally ancillary. Providing an HR-processing service to customers is a different case: that processing can be central to the service. ICO guidance.
For large-scale processing, consider the number of people affected, the amount and range of data, the duration and geographical reach. There is no universal employee-count shortcut to the GDPR test. An assessment should explain how those factors apply to your product and services, not simply state that you are a startup.
Special-category data has a defined meaning under Article 9. It includes health and genetic data, and biometric data processed to uniquely identify someone, alongside the other listed categories. It does not mean every piece of information you consider sensitive. Criminal-conviction and offence data is addressed separately in Article 10 and must not be left out of the DPO assessment. GDPR, Articles 9, 10 and 37.
The edge cases founders ask about
Separate the legal appointment test from the practical question of who should oversee privacy. Both matter, but they are not interchangeable.
Does an ICO fee letter mean we need a DPO?
No. The UK data protection fee is a separate obligation with its own exemptions. Use the ICO’s fee guidance to assess the fee, and its DPO guidance to assess appointment. The fee letter is not a DPO determination. ICO fee guidance.
Can the founder or director be the DPO?
Check the person’s actual responsibilities. A DPO must be able to monitor compliance independently, without conflicting duties. Someone who determines the purposes and means of the processing they would monitor may have a conflict. Outsourcing can help, but the same independence and conflict checks apply to an external appointment. GDPR, Article 38.
What if a customer asks for a DPO?
Explain your documented legal assessment and ask what assurance the customer needs. They may accept a named privacy lead and clear governance arrangements, or the contract may require a formal DPO. If you appoint voluntarily, do not treat the title as a questionnaire shortcut: the statutory position and tasks still apply.
Do EU national rules matter?
Yes. Germany is one example of a jurisdiction with additional appointment rules under section 38 BDSG, including requirements that can apply independently of the GDPR’s main triggers. Check which laws apply to your organisation and processing; selling into a country does not, on its own, answer every territorial-scope question. Brandenburg supervisory authority.
Why appoint voluntarily?
A DPO can provide useful oversight even when appointment is not mandatory. The value is in the work and independence, not the title.
A properly supported DPO can advise on impact assessments, monitor the privacy programme, raise issues with senior management and provide a clear contact for individuals and regulators. Those arrangements can also help you explain your privacy governance to customers. They are not a guarantee of winning a deal or complying with every requirement. DPC guidance.
If you do not need the statutory role, a named privacy lead may be the right operational choice. Give that person time, support and a clear remit. Calling someone a privacy lead does not remove the organisation’s GDPR obligations.
What appointment involves
Give the DPO access, independence and resources, and keep accountability with the organisation.
The DPO advises and monitors; management remains responsible for decisions and compliance. GDPR, Articles 5, 24 and 38-39.
Record the reporting line, access to relevant processing information, responsibilities and arrangements for conflicts. Publish the DPO’s contact details and communicate them to the relevant supervisory authority: for example, the Irish DPC or the UK ICO. An external service agreement should explain availability, escalation, cover during absence and which additional operational services are included.
What if we decide not to appoint?
Record why no applicable requirement is met and revisit the assessment when the business changes. That record supports accountability; it is not immunity from enforcement.
A new profiling feature, entry into a regulated market or a change in the scale or nature of processing can change the answer. Keep privacy responsibilities assigned in the meantime. Not needing a DPO does not mean not needing a privacy programme.
FAQs
1. Is there a small-company exemption?
No blanket headcount exemption applies to the GDPR appointment test. Assess the processing activities and any additional applicable law, even if your team is small.
2. Does a customer questionnaire create a legal requirement?
Not by itself. It may reveal a contractual requirement, which should be assessed separately from the statutory appointment test.
3. Can our director also be the DPO?
Only if the role can satisfy the expertise, independence and conflict requirements. A director who determines the processing being monitored may not be suitable.
4. Is an outsourced DPO automatically independent?
No. Check the provider’s other responsibilities, reporting arrangements and potential conflicts, just as you would for an internal appointment.
5. What are the benefits if appointment is voluntary?
A DPO can provide independent advice, oversight and an accessible privacy contact. The organisation must still give the role the support required for a statutory DPO.
6. How should we compare outsourced DPO quotes?
Compare scope, not just the monthly fee. Ask about the named DPO, availability, impact-assessment advice, regulator contact, reporting and any limits on additional operational support.
7. Is a DPO the same as an EU or UK representative?
No. A representative under Article 27 has a different purpose and appointment test; a DPO performs the role described in Articles 37-39.
8. What should we record if we do not appoint?
Record the processing examined, applicable legal tests, reasoning and owner of the assessment. Set a review point and revisit it after material changes.
For help deciding whether you need a statutory DPO or a different privacy-support arrangement, book a scoping conversation with Atoro. Start with the processing you carry out and the support your team needs.
Sources
- EU GDPR, Articles 9, 10, 24, 27 and 37-39: https://eur-lex.europa.eu/eli/reg/2016/679
- ICO, Data protection officers: https://ico.org.uk/DPOs
- DPC, Data Protection Officers: https://www.dataprotection.ie/en/organisations/know-your-obligations/data-protection-officers
- ICO, Data protection fee: https://ico.org.uk/for-organisations/data-protection-fee/
- Brandenburg supervisory authority, DPO appointment requirements: https://www.lda.brandenburg.de/lda/de/datenschutz/auslegungshilfen-der-landesbeauftragten/dsb-rechtliche-anforderungen-unter-der-ds-gvo/