Data Protection Officers - Who Needs Them?

Do you need a Data Protection Officer? The GDPR makes a DPO mandatory for some organisations and optional for the rest. This guide explains how to tell which group you belong to, what a DPO actually does, and how to keep data protection running smoothly either way.

Updated October 2026.

The GDPR has applied since May 2018, and its reach extends well beyond Europe: any organisation that processes personal data about people in the EU must comply, wherever it is based. One requirement that still causes uncertainty is the Data Protection Officer (DPO). Who has to appoint one, and what should the role look like in practice?

When is a DPO mandatory?

Article 37 of the GDPR requires controllers and processors to designate a DPO in three situations:

Public authorities and bodies, regardless of what data they process. Courts acting in their judicial capacity are exempt.
Organisations whose core activities involve regular and systematic monitoring of individuals on a large scale, for example behavioural advertising, location tracking, loyalty programmes or connected devices.
Organisations whose core activities involve large-scale processing of special categories of data, such as health data, or of data about criminal convictions and offences.

Core activities are the key operations an organisation needs to achieve its goals. A hospital processing patient records is a clear example. Supporting functions such as payroll or standard IT support usually fall outside that definition.

The regulation leaves "large scale" undefined. The Guidelines on Data Protection Officers, endorsed by the European Data Protection Board (EDPB), recommend looking at the number of people concerned, the volume and range of data, how long the processing lasts and its geographical extent.

National rules can go further

Article 37(4) allows member states to require a DPO in more cases. Germany is the best-known example: under the Federal Data Protection Act (BDSG), organisations generally need a DPO once at least 20 people are regularly involved in the automated processing of personal data. If you operate in several countries, check the national rules in each of them.

What counts as a public authority or body is also determined by national law, so the same type of organisation can be treated differently from country to country.

When a DPO is optional

If none of the criteria apply, you can still appoint a DPO voluntarily. The guidelines recommend documenting your assessment of whether a DPO is required, so you can show the supervisory authority how you reached your conclusion. Keep in mind that a voluntarily appointed DPO is subject to the same rules as a mandatory one.

Internal, external or shared DPO

The GDPR gives you flexibility in how you fill the role. The DPO can be a member of staff or an external provider working under a service contract. A group of companies can appoint a single DPO, as long as the DPO is easily accessible from every establishment, and public authorities can share a DPO as well.

Whichever model you choose, the DPO needs expert knowledge of data protection law and practice and enough resources to do the job. The DPO's contact details must be published and reported to the supervisory authority.

Need GDPR expertise without a full-time hire? NorthGRC's consultants can support your data protection work on demand, from assessing your obligations to building the processes around them.

Explore our advisory services ->

What does a DPO do?

Under Article 39, the DPO's tasks include:

Informing and advising the organisation and its employees about their data protection obligations
Monitoring compliance with the GDPR and internal policies, including awareness training and audits
Advising on data protection impact assessments (DPIAs) and monitoring how they are carried out
Cooperating with the supervisory authority and acting as its contact point
Acting as the contact point for individuals with questions about how their data is processed

Article 38 protects the role. The DPO must report to the highest level of management, must be able to act independently, and cannot be dismissed or penalised for performing their tasks. The DPO may hold other roles, provided they don't create a conflict of interest. In practice, that excludes positions where the person decides the purposes and means of processing, which in many organisations includes senior management and heads of IT, HR or marketing.

Responsibility for compliance stays with the organisation. The DPO advises and monitors, while management and the business own the processes and controls that keep the organisation compliant.

Where organisations struggle

In 2023, data protection authorities across Europe examined how DPOs are designated and positioned as part of a coordinated enforcement action. The EDPB's report, adopted in January 2024, pointed to recurring problems: organisations failing to appoint a DPO where it was mandatory, DPOs lacking resources or expert knowledge, unclear tasks, conflicts of interest and limited reporting to top management.

Appointing a DPO is the first step. To make a difference, the role needs time, a clear mandate and a good view of what is happening across the organisation.

Making GDPR compliance part of everyday work

With or without a DPO, every organisation that processes personal data has to meet the GDPR's requirements: keeping records of processing activities, assessing risks, handling data subject requests, managing data processors and responding to breaches. The hard part is keeping all of this current as systems, suppliers and processes change.

Spreadsheets and shared folders tend to drift out of date, and the knowledge ends up with one or two people. A structured system gives the DPO, or whoever is responsible for data protection, an overview of tasks and status, and makes it easier to involve the rest of the organisation.

Make GDPR part of everyday operations. NorthGRC's Data Protection Workbench brings your data protection documentation, tasks and risk assessments together in one place, so compliance keeps running with or without a DPO.

See the Data Protection Workbench ->