Under Article 37 of the General Data Protection Regulation (GDPR), you must appoint a data protection officer (DPO) in three cases:
- you are a public authority or body (courts acting in their judicial capacity excepted)
- your core activities involve regular and systematic monitoring of people on a large scale
- your core activities involve large-scale processing of special category data or criminal records
If none of these applies, a DPO is optional, unless national law asks for more, as Germany's does. Either way, document how you reached your answer.
A DPO is an independent expert inside or outside your organisation who informs, advises and monitors on data protection. The rules dictate not just when you need one, but who can fill the position and how they must operate. A DPO reports directly to the highest level of management, takes no instructions on how to do the job, and cannot be dismissed or penalised for doing it. If your marketing team wants to deploy an invasive tracking tool, the DPO advises on the Data Protection Impact Assessment (DPIA), and the controller must document any decision to go against that advice.
When GDPR Article 37 makes a DPO mandatory
The GDPR made the DPO a cornerstone of accountability. Articles 37 to 39 of the GDPR set out when one is required, what the role demands and what the DPO does. The obligation applies equally to controllers and processors.
Do you need a DPO under Article 37(1)?
Public authorities and bodies
Article 37(1)(a) requires any public authority or body to appoint a DPO. Courts acting in their judicial capacity are the sole exception. The definition of a public body is determined by national law, so it varies across member states. It generally covers government departments, local councils and state-funded institutions such as public schools, state hospitals and public transport operators. Private companies carrying out public functions may also fall under it, depending on the country.
Regular and systematic monitoring on a large scale
Article 37(1)(b) applies when your core activities require the regular and systematic monitoring of individuals on a large scale. This is the trigger that catches digital businesses, marketing agencies and software-as-a-service providers.
"Regular" monitoring means the tracking is ongoing, recurring at fixed times, or taking place periodically. "Systematic" means it is pre-arranged, methodical, or carried out as part of a broader strategy for data collection. Behavioural advertising, location tracking via mobile apps and detailed profiling for credit scoring all count. If your business model relies on analysing user journeys to predict purchasing habits, you are engaging in this activity. Tracking pixels from Meta, TikTok or programmatic advertising networks feed user behaviour back to central servers, and running them to target campaigns at millions of people meets both criteria.
Large-scale processing of sensitive data
Article 37(1)(c) covers the large-scale processing of special categories of personal data or data about criminal convictions. Article 9 defines special categories as data revealing racial or ethnic origin, political opinions, religious beliefs or trade union membership, plus genetic data, biometric data used for identification, health data, and data about a person's sex life or sexual orientation.
A private hospital network, a genetic testing laboratory or an insurer processing thousands of medical claims are typical examples. To know where you stand, run a data mapping exercise that shows which categories of information flow through your systems.
National rules can add more
Article 37(4) lets EU or national law require a DPO in other cases. Germany does: under section 38 of the Federal Data Protection Act (BDSG), a private organisation must appoint one if it normally has at least 20 people permanently working on the automated processing of personal data, or if it carries out processing that needs a DPIA. Check the law of each country where you have an establishment.
How to read "large scale" and "core activities"
The GDPR leaves "large scale" open, so the assessment depends on context. Recital 91 gives some guidance, and the Article 29 Working Party's guidelines on data protection officers (WP243rev.01), endorsed by the EDPB, list four factors to weigh:
- the number of data subjects concerned, as a specific number or a proportion of the relevant population
- the volume of data and the range of data items processed
- the duration or permanence of the processing
- the geographical extent of the processing
Processing the data of 50 employees is not large scale. Tracking the browsing habits of two million monthly website visitors almost certainly is. A single email address from a million people carries a different risk from the detailed medical histories of fifty thousand patients, and continuous collection weighs more than a one-off survey.
Core activities are the primary operations your business needs to achieve its goals. If you run a digital marketing agency, processing data to execute targeted campaigns is your core activity. Ancillary tasks are the supporting functions every business has: paying employees, running standard IT and keeping client contact details. Every business processes payroll, but that does not mean every business needs a DPO. If processing personal data is inextricably linked to how you make money, it is a core activity. Document the assessment so you can explain your decision to a regulator.
Who can be the DPO: expertise and independence
The person you appoint must have expert knowledge of data protection law and practice. The GDPR does not demand a specific certification, but the knowledge must match the complexity of your processing. A DPO needs to understand the GDPR, relevant national laws and the technical side of information security, and to translate legal requirements into practical instructions for your developers and marketers.
Resources matter as much as qualifications. In its 2023 coordinated enforcement action on DPOs, 25 data protection authorities received more than 17,000 replies. The EDPB report on it, adopted on 17 January 2024, found that most DPOs consider they have the means to do their job but "there are still too many DPOs who are not in such a position", and it recommends giving DPOs the time and resources to keep their knowledge up to date (EDPB coordinated enforcement report).
Article 38 sets out the DPO's independence. You cannot instruct them on how to investigate a complaint, what result an audit should reach, or whether to consult the supervisory authority. They report directly to the highest level of management, such as the board of directors, and you cannot dismiss or penalise them for performing their tasks.
A DPO also cannot hold a position that determines the purposes and means of processing personal data. Roles such as chief executive, chief operating officer, chief financial officer, head of marketing and head of IT usually create that conflict. The DPO is an impartial adviser and cannot audit their own decisions: a head of marketing who designs a targeted advertising campaign cannot also be the DPO who assesses whether it is lawful.
What the DPO does
Article 39 defines the minimum tasks. The DPO informs and advises your organisation and your employees about their obligations under the GDPR and national data protection laws, and monitors compliance through internal audits, awareness-raising and training.
The DPO advises on the DPIA process. When your company plans a high-risk technology, such as facial recognition or AI profiling, you must carry out a DPIA, and the DPO advises on its method, the risks and whether the proposed safeguards are enough. The DPO is also the contact point for the supervisory authority, and usually coordinates the response when a breach has to be reported.
Data subjects can contact the DPO about their rights, so DPOs typically oversee data subject access requests. Article 12(3) requires a response within one month of receipt, extendable by two further months for complex or numerous requests. If your data sits across dozens of cloud platforms, the DPO needs a clear internal process to find it, redact other people's data and meet the deadline.
Cookies are part of the job for any business that tracks visitors. The DPO checks that no non-essential cookies load before a visitor agrees, that withdrawing consent is as easy as giving it, and that your privacy notice matches what your site actually sets. On a large website, that check needs a cookie scanner to find third-party trackers added by marketing tags, and access to your cookie consent records to show what visitors agreed to.
Internal, external or shared DPO
You do not have to hire a full-time employee. Article 37(6) lets you appoint a DPO under a service contract with an external provider, which suits small and medium-sized organisations that cannot justify a full-time privacy lawyer. If you outsource, make sure the provider names a lead contact and has the sector expertise you need.
Article 37(2) lets a group of undertakings appoint a single DPO, provided that person can be reached readily from each establishment. Accessibility covers language, availability and location: if your group operates in Germany, Spain and France, the DPO must be able to deal with authorities and data subjects in those countries. They also need the time to handle the workload of every company in the group, so document why one DPO is enough.
Whether internal or external, the DPO needs access to your processing records, consent records and technical systems.
Publishing the DPO's contact details
Article 37(7) requires you to publish the DPO's contact details and communicate them to your supervisory authority. Most organisations publish them in the privacy policy. You do not have to publish the DPO's name, but you must give a direct way to reach them, such as a dedicated email address, telephone number or contact form. Each authority has its own way of receiving the details: in Ireland you notify the Data Protection Commission, and in the UK the ICO collects them through its registration process.
Fines and liability
Breaches of the DPO provisions (Articles 37 to 39) fall under Article 83(4): fines of up to €10 million or 2% of worldwide annual turnover, whichever is higher. A missing or conflicted DPO also tends to come up when a regulator investigates something else, such as a breach.
Conflict of interest has been fined. In decision 18/2020 of 28 April 2020, the Belgian data protection authority found that a company's DPO, who was also its director of audit, risk and compliance, was not in a sufficiently protected position, and imposed a €50,000 fine covering this and other failings. Naming an IT manager or head of compliance as DPO to fill the title will not stand up to scrutiny.
A common myth is that the DPO is personally liable for GDPR fines. The GDPR puts responsibility on the controller or processor. The DPO advises, monitors and reports, but does not make the final decisions. If a company ignores its DPO's advice and goes ahead with an unlawful tracking campaign, the company bears the fine, and the DPO's documented advice shows that the risk was raised.
You cannot make your DPO carry regulatory fines through their employment contract. An external DPO working under a service contract may still face ordinary commercial liability for negligent advice, but that comes from the contract, not the GDPR.
Questions about DPOs
Can our IT Director act as the Data Protection Officer?
Usually not. An IT director typically decides how data is processed and stored, which creates a conflict of interest. Article 38(6) does not allow a DPO to hold tasks that conflict with the role, and regulators treat roles that decide the purposes and means of processing as conflicting.
Does a small business need a DPO under GDPR?
A small business only needs a DPO if its core activities involve large-scale monitoring of individuals or large-scale processing of sensitive data, or if national law requires one. Employee headcount alone does not decide it under the GDPR, but some countries, such as Germany, add their own thresholds.
Can you appoint a temporary or interim DPO?
Yes. The GDPR does not set a minimum term, so an interim or external DPO can fill the role while you recruit, provided they have the expertise, independence and resources the role needs. Update the published contact details and tell your supervisory authority when the DPO changes.
Do we need to notify the ICO if we appoint a DPO?
Yes. Under the UK GDPR, you must communicate your DPO's contact details to the Information Commissioner's Office (ICO) and publish them, for example in your privacy notice.
What is considered regular and systematic monitoring?
This includes tracking users across the internet, behavioural advertising, profiling, and using analytics tools to monitor user journeys. If tracking visitors is a core part of how your business makes money and you do it on a large scale, the DPO requirement is likely to apply.
Is the DPO personally liable for GDPR fines?
No. The controller or processor bears the legal and financial responsibility under the GDPR. The DPO is an adviser and monitor, not the final decision-maker on data processing.
Can a DPO be fired for disagreeing with the CEO?
No. Article 38(3) protects the DPO from being dismissed or penalised for performing their tasks. Firing a DPO for giving inconvenient advice breaks the independence the GDPR requires.
Give your DPO a clear view of your cookies
If your website relies on tracking pixels, analytics or behavioural advertising, your DPO needs to know what it sets and what visitors agreed to. Kukie.io scans your pages, sorts each cookie into a category, blocks non-essential ones until visitors choose and keeps a record of every choice.
