GDPR DPO Requirements: Do You Need a Data Protection Officer? (2026)

GDPR Articles 37-39 require certain controllers and processors to appoint a Data Protection Officer (DPO). The obligation is mandatory in three scenarios: you are a public authority or body; your core activities require large-scale regular and systematic monitoring of individuals; or your core activities involve large-scale processing of special-category or criminal-conviction data.

When Is a DPO Mandatory? The Three Triggers of Article 37(1)

Article 37(1) of Regulation (EU) 2016/679 sets out three conditions, any one of which triggers a mandatory obligation to designate a DPO. Meeting a single trigger is sufficient.

Recital 97 confirms this framework and adds that the required level of DPO expert knowledge should correspond to the complexity of the processing operations.

Trigger One: Public Authority or Body (Article 37(1)(a))

Every public authority or body must appoint a DPO regardless of the scale or sensitivity of its processing. The trigger is unconditional: no volume threshold, no particular data category, no specific activity type is required.

The express carve-out covers courts acting in their judicial capacity. Recital 20 explains that judicial independence requires supervisory authorities not to scrutinise courts' case-handling directly. Courts' other administrative functions (payroll, human resources, building management) remain subject to GDPR; those activities fall outside the judicial-capacity exemption.

What counts as a public authority depends on national law in each EU Member State. Central government departments, regional and local authorities, regulatory agencies, state-funded public broadcasters, publicly funded universities, and public hospitals are the paradigm cases. Mixed public-private bodies and state-owned enterprises may or may not qualify depending on the constitutional and administrative law of the relevant Member State.

Trigger Two: Large-Scale Regular and Systematic Monitoring (Article 37(1)(b))

Trigger Two applies to controllers and processors whose core activities require regular and systematic monitoring of data subjects on a large scale. Both limbs require scrutiny: "regular and systematic monitoring" and "large scale" are distinct qualifications.

What "Regular and Systematic Monitoring" Means

The former Article 29 Working Party (WP29), whose guidelines were adopted by the European Data Protection Board (EDPB) on 25 May 2018, addressed this in WP243 rev.01. "Regular" means ongoing, recurring at fixed intervals, or occurring constantly or periodically. "Systematic" means occurring according to a system, pre-arranged or methodical, or carried out as part of a general data-collection plan.

WP243 gives these examples of activities that may constitute regular and systematic monitoring: operating a telecommunications network; providing telecommunications services; email retargeting; data-driven marketing; profiling and scoring for risk assessment (for example credit scoring, setting insurance premiums, fraud prevention or anti-money-laundering checks); location tracking, for example by mobile apps; loyalty programmes; behavioural advertising; monitoring wellness, fitness and health data through wearables; closed circuit television; and connected devices such as smart meters, smart cars and home automation.

What "Large Scale" Means

GDPR does not define "large scale" numerically. Recital 91 states that large-scale processing aims to handle a considerable amount of personal data at a regional, national, or supranational level and could affect a large number of data subjects. As a counterexample, Recital 91 notes that a single doctor or lawyer handling patient or client data does not constitute large-scale processing.

WP29 identified four assessment factors: the number of data subjects (absolute or as a proportion of the relevant population); the volume or range of data items processed; the duration or permanence of the activity; and the geographical extent.

WP243 gives these examples of large-scale processing: patient data processed by a hospital in the regular course of business; travel data of people using a city's public transport system (for example, tracked through travel cards); real-time geo-location data of an international fast food chain's customers, processed for statistical purposes by a processor specialised in that service; customer data processed in the regular course of business by an insurance company or a bank; personal data processed for behavioural advertising by a search engine; and content, traffic and location data processed by telephone or internet service providers. Not large scale: a single doctor or specialist processing patient records; a single lawyer processing client data.

Trigger Three: Large-Scale Processing of Special-Category or Criminal-Conviction Data (Article 37(1)(c))

Trigger Three focuses on data sensitivity rather than monitoring type. It applies when core activities consist of large-scale processing of the special categories listed in Article 9(1) or criminal-conviction data under Article 10.

Article 9(1) enumerates eight special categories: racial or ethnic origin; political opinions; religious or philosophical beliefs; trade-union membership; genetic data; biometric data processed to uniquely identify a person; health data; and sex life or sexual orientation data.

Article 10 data relates to criminal convictions and offences. Most organisations processing Article 10 data in their core activities do so under a specific statutory gateway. The large-scale requirement still applies; a small charity running a single background check on a volunteer does not trigger this limb.

Organisations likely to meet Trigger Three: a private health insurer processing medical-underwriting data for its entire customer base; a recruitment firm conducting large-scale criminal-record checks; a genetic testing service processing DNA from hundreds of thousands of consumers; a biometric access-control provider covering a large workforce.

The Concept of "Core Activities"

Triggers Two and Three both require that the relevant processing form part of the organisation's "core activities." Processing that is ancillary or supportive does not trigger the DPO obligation.

WP29 drew the line between primary business functions and support functions such as payroll, IT management, and human resources. A hospital processes health data as a core activity because healthcare is its primary purpose. Its payroll processing, though it involves personal data, is ancillary and does not trigger Trigger Three.

A security company monitoring shopping centres and public spaces with CCTV engages in regular and systematic monitoring as a core activity because surveillance is the primary service it sells. A supermarket that installs CCTV for theft prevention uses surveillance as a secondary tool, not a primary offering.

Many medium-sized businesses process personal data extensively in HR systems, CRM platforms, and accounting software, but none of those activities are core in the GDPR sense. A manufacturer whose primary activity is producing goods processes employee and customer data as support functions. If its core activity does not involve large-scale monitoring or large-scale special-category processing, no mandatory DPO obligation arises under Triggers Two or Three.

Voluntary DPO Appointment

Article 37(4) confirms that where appointment is not mandatory, organisations "may or shall" designate a DPO. The "shall" language refers to possibilities in Member State or Union law requiring designation beyond the Article 37(1) baseline; organisations should check national implementing legislation.

Germany is one example. Section 38 of the Federal Data Protection Act (BDSG) requires private controllers and processors to designate a DPO if they generally employ at least 20 people constantly engaged in automated processing of personal data. Regardless of headcount, they must also designate one if they carry out processing that requires a DPIA under Article 35, or process personal data commercially for transfer, anonymised transfer, or market or opinion research.

WP243 encourages voluntary designation where a DPO is not mandatory. A voluntary DPO can help demonstrate accountability, build regulatory trust, and reduce the risk of undetected violations.

Critically, Articles 38 and 39 apply in full to a voluntary DPO. An organisation cannot appoint a nominal DPO stripped of independence or shielded from the conflict-of-interest rules.

Who Can Serve as DPO?

Qualifications Required

Article 37(5) requires designation based on professional qualities and expert knowledge of data protection law and practices, plus the ability to carry out the Article 39 tasks. No prescribed qualification or examination exists. Required expertise is proportionate to data sensitivity and processing complexity.

WP29 identified relevant areas of expertise: national and European data protection laws; the organisation's sector and subject matter; the organisation's business and IT infrastructure; compliance-function management; and international data transfer frameworks.

For a small organisation collecting only basic contact data for a newsletter, a competent employee with a reasonable GDPR understanding may suffice. For a large multinational processing biometric data, running behavioural advertising, and transferring data across jurisdictions, specialised legal and technical expertise is appropriate.

Staff Member or External Service Provider

Article 37(6) expressly allows the DPO to be a staff member or to fulfil the role under a service contract. The external DPO model has grown significantly since GDPR took effect. Law firms, consultancies, and specialist privacy providers offer shared or fractional DPO services.

When the DPO is external, the service contract must be structured so that Articles 38 and 39 are met. The external DPO must have genuine access to the organisation's processing operations and management, not merely serve as a nominal compliance contact.

Group-Level DPO and Multi-Authority DPO

Article 37(2) permits a group of undertakings to appoint a single DPO, provided that DPO is easily accessible from each establishment. Article 37(3) similarly permits a single DPO for several public authorities or bodies, taking into account their organisational structure and size.

"Easily accessible" is a functional requirement. The DPO must be reachable by employees, data subjects, and supervisory authorities without undue difficulty. WP243 points to making the DPO's contact details available, communicating in the languages used by the supervisory authorities and data subjects concerned, and being available whether on the same premises, by hotline or by other secure means. It also recommends that the DPO be located within the European Union, whether or not the controller or the processor is established there.

Article 37(7) requires that controllers and processors publish the DPO's contact details and communicate them to their supervisory authority. Full identity need not be published, but a contact address accessible to data subjects must be.

The DPO's Tasks Under Article 39

Article 39(1) enumerates five minimum tasks. The "at least" language makes clear that Member State law, the DPO's terms of engagement, or the organisation's own governance may assign additional responsibilities.

Task One: Inform and Advise (Article 39(1)(a))

The DPO must inform and advise the controller, processor, and employees about GDPR obligations and other applicable data-protection provisions. This encompasses guidance on lawful processing bases, consent mechanisms, data-subject rights procedures, staff training, and data-protection strategy.

The DPO informs and advises; the DPO does not decide. Under Article 38(3), the DPO cannot receive instructions in the exercise of their tasks, but the controller or processor retains decision-making authority over how personal data is processed. The DPO's role is to ensure decision-makers understand the legal landscape and to flag non-compliant directions.

Task Two: Monitor Compliance (Article 39(1)(b))

The DPO must monitor compliance with GDPR, other applicable data-protection provisions, and the organisation's own data-protection policies. Monitoring involves: assigning data-protection responsibilities; conducting internal audits; reviewing processing agreements and data-sharing arrangements; updating records of processing activities; monitoring data-subject rights requests; and tracking technical and organisational security measures.

Article 39(1)(b) also references raising awareness and training staff. The DPO therefore has a standing obligation to keep the workforce current on GDPR requirements as the regulatory framework and the organisation's processing operations evolve.

Task Three: Advise on DPIAs (Article 39(1)(c))

Where a new processing activity is likely to result in a high risk to data subjects, Article 35 requires a Data Protection Impact Assessment (DPIA) before processing begins. The DPO provides advice on the DPIA and monitors its performance.

Under Article 38(1), the DPO must be involved "properly and in a timely manner" and should be consulted at the outset of any project likely to require a DPIA. The DPO's advice and the controller's response should be documented alongside the DPIA record. WP243 recommends that the controller seek the DPO's advice on, among other things, whether to carry out a DPIA, which methodology to follow, and whether the DPIA has been correctly carried out and its conclusions comply with the GDPR.

If a controller proceeds with a high-risk processing activity over the DPO's documented objection, both the DPO's advice and the controller's decision should be recorded in writing. That documentation evidences the DPO's independence and the controller's accountability under Article 5(2).

Task Four: Cooperate with the Supervisory Authority (Article 39(1)(d))

The DPO must cooperate with the supervisory authority. Cooperation includes facilitating inspections and investigations; providing information under the DPA's Article 58 investigative powers; participating in meetings or hearings; and managing data-breach notifications to the DPA under Article 33.

Task Five: Act as Contact Point for the Supervisory Authority (Article 39(1)(e))

The DPO acts as the supervisory authority's contact point on processing issues, including the controller's prior consultation under Article 36, and may consult the authority on any other matter where appropriate. Prior consultation is the mechanism by which a controller that cannot mitigate DPIA-identified risks to an acceptable level consults the supervisory authority before commencing processing.

The contact-point function also means data subjects have a published address for exercising GDPR rights. Article 37(7) ensures the DPO's contact details are publicly available, and Article 38(4) confirms that data subjects may contact the DPO on all processing and rights issues.

The Risk-Based Approach in Practice

Article 39(2) requires the DPO, across all five tasks, to account for the risk associated with processing operations, having regard to nature, scope, context, and purposes. A proportionate, risk-based approach directs attention toward activities most likely to create high risks: profiling, automated decision-making, large-scale special-category processing, and cross-border transfers without adequate safeguards.

DPO Independence and Protection from Dismissal (Article 38)

No Instructions Permitted

Article 38(3) states that the DPO "shall not receive any instructions regarding the exercise of those tasks." This prohibition applies at all management levels. The DPO reports directly to the highest management level, which in most corporate structures means the board or an equivalent governance body.

A DPO who determines that a processing activity is unlawful cannot be ordered to approve it. A DPO who believes the organisation is underreporting data breaches cannot be silenced. The DPO must be free to escalate concerns to the supervisory authority under Article 39(1)(d) without internal approval.

Protection from Dismissal and Penalties

Article 38(3) prohibits dismissing or penalising the DPO for performing their tasks. The Court of Justice held in Leistritz (C-534/20, 22 June 2022) that this protection applies whether the DPO is an employee or works under a service contract. The same judgment allows Member States to give stronger protection: Germany allows a mandatory DPO to be removed only for good cause and bars ordinary dismissal of an employed one (section 6(4) BDSG, applied to private bodies by section 38(2)). A breach of Article 38 can also be fined under Article 83(4).

The protection applies to both employed and external-service-provider DPOs. A controller cannot terminate the DPO's service contract in retaliation for the DPO raising compliance concerns. Contract terms giving the controller an unfettered right to terminate without cause may undermine the independence requirement if used to suppress lawful DPO activity.

Resources and Access

Article 38(2) requires the controller and processor to provide the resources necessary to carry out Article 39 tasks and maintain expert knowledge, plus access to personal data and processing operations. Resources include time, training and professional development funding, and administrative support. For a part-time or external DPO, this includes meaningful access to systems, documentation, and personnel.

A DPO who cannot obtain records of processing activities, attend meetings where processing decisions are made, or review procurement contracts involving personal data lacks the access necessary to carry out Article 39(1)(b) monitoring.

Conflict of Interest

Article 38(6) allows the DPO to fulfil other tasks and duties, but the controller or processor must ensure those tasks create no conflict of interest with the DPO's oversight function.

WP243 rev.01 gives, as a rule of thumb, senior management positions that may conflict with the DPO function, such as chief executive, chief operating officer, chief financial officer, chief medical officer, head of marketing, head of HR or head of IT, as well as lower roles that lead to determining the purposes and means of processing, and says this has to be considered case by case. In smaller organisations where one person holds multiple roles, the DPO function must remain ring-fenced from roles that set processing objectives.

The test is functional, not nominal. Changing a job title from "IT Manager" to "DPO" while leaving substantive responsibilities unchanged does not cure the conflict. The Court of Justice confirmed this test in X-FAB Dresden (C-453/21, 9 February 2023): a conflict of interests may exist where the DPO is given other tasks or duties that would lead them to determine the objectives and methods of processing, which the national court must assess case by case.

External DPOs face their own risks: a law firm that advises a client on the legality of a processing strategy while simultaneously serving as DPO may face a conflict when the DPO function requires advising against that strategy. Organisations using external DPO services should confirm the provider has governance measures to manage those conflicts.

Consequences of Non-Compliance

Fines Under Article 83(4)

Violations of Articles 37, 38, and 39 fall within GDPR's lower fine tier under Article 83(4), which covers obligations pursuant to Articles 8, 11, 25-39, 42, and 43. The maximum is EUR 10 million or 2% of the undertaking's total worldwide annual turnover for the preceding financial year, whichever is higher.

DPO-related infringements can include: failing to appoint a required DPO; appointing a DPO who lacks qualifications or independence; assigning the DPO to a conflicting role; failing to provide sufficient resources or access; and failing to publish the DPO's contact details.

Enforcement in Practice

In 2023, 25 supervisory authorities across the EEA ran a coordinated enforcement action on the designation and position of DPOs. The EDPB report on it, adopted on 16 January 2024, flagged organisations that had not designated a DPO even where one was mandatory, insufficient resources and expert knowledge, DPOs not fully entrusted with their GDPR tasks, and risks of conflicts of interests.

Failure to publish the DPO's contact details is among the simplest violations for a supervisory authority to detect: it is visible on the face of a privacy policy.

Non-Fine Consequences

Non-compliance with DPO requirements undermines accountability under Article 5(2). A controller that lacks a required DPO has a structural accountability deficit that can aggravate the penalty for any associated GDPR violation found in the same investigation.

For B2B businesses, procurement teams conducting GDPR due diligence on vendors and sub-processors increasingly request evidence of DPO appointment, DPO contact details, and records of processing activities. The absence of a required DPO is a material finding in enterprise vendor-risk assessments.

UK GDPR and the DPO Requirement

The United Kingdom retained GDPR as domestic law through the European Union (Withdrawal) Act 2018 and the Data Protection Act 2018. UK GDPR mirrors the EU text with minor modifications. Articles 37, 38, and 39 of UK GDPR reproduce the EU equivalents almost word-for-word, and the three mandatory triggers are unchanged.

The Information Commissioner's Office (ICO) is the supervisory authority for UK GDPR. The ICO closely tracks the WP29 approach and applies the same "large scale" and "core activities" analytical framework as EU DPAs. Organisations subject to both regimes may appoint separate DPOs or a single DPO covering both, provided that DPO is accessible to both supervisory authorities, employees, and data subjects.

The UK GDPR fines regime is denominated in sterling: the lower tier is up to GBP 8.7 million or 2% of global annual turnover, whichever is higher.

The ICO's DPO guidance says it is under review because of changes made by the Data (Use and Access) Act 2025. As of October 2026, legislation.gov.uk showed no outstanding changes to UK GDPR Articles 37 to 39.

How to Assess Whether Your Organisation Needs a DPO

Start with Trigger One: is the organisation a public authority or body under the national law of the relevant EU Member State? If yes, a DPO is mandatory. If the organisation operates across multiple Member States, check whether any of them classify the entity as a public body.

If not a public authority, identify the core business activities. For each core activity, ask: does this activity require regular and systematic monitoring of individuals? If yes, is that monitoring conducted on a large scale? If both answers are yes, Trigger Two applies.

Then for each core activity ask: does this activity involve processing Article 9(1) special-category data or Article 10 criminal-conviction data? If yes, is that processing conducted on a large scale? If both answers are yes, Trigger Three applies.

Document the analysis. Even where no mandatory DPO is required, a documented assessment demonstrates accountability under Article 5(2) and protects the organisation if a supervisory authority later questions the decision. Update the assessment whenever processing activities change materially, including through acquisitions, new product lines, or changed data-sharing arrangements.

For how DPO obligations fit within the broader GDPR compliance programme, the GDPR compliance checklist provides a structured overview of controller and processor obligations. Organisations outside the EU assessing whether GDPR applies at all can start with the GDPR for small businesses guide. For a complete introduction to the regulation, see what is GDPR.

Disclaimer: This article provides general legal information about GDPR Data Protection Officer requirements and is not legal advice. GDPR compliance is fact-specific, and the application of Articles 37-39 to any particular organisation depends on its specific processing activities, legal status, and the national law of the relevant Member State. Consult a qualified data protection practitioner or legal counsel for advice tailored to your situation.

Frequently Asked Questions

Do small businesses need a DPO under GDPR?

Small businesses are not automatically exempt from the DPO requirement under Article 37. Recital 13 notes a record-keeping derogation for organisations with fewer than 250 employees and encourages Member States and supervisory authorities to take account of the needs of micro, small and medium-sized enterprises, but Article 37 contains no SME exemption. A small business that meets any of the three mandatory triggers in Article 37(1) must appoint a DPO. In practice, most small businesses do not engage in large-scale processing as a core activity and are not public authorities, so the triggers are unlikely to apply. Under EU law the obligation turns on the nature and scale of processing, not on workforce size or turnover, but national law can add triggers: in Germany, section 38 BDSG requires a DPO once a business generally has at least 20 people constantly engaged in automated processing of personal data. A startup operating a health-data app with hundreds of thousands of users could trigger Article 37(1)(c) even if it employs fewer than 20 people.

Can a DPO be an external consultant or service provider?

Yes. Article 37(6) expressly states that the DPO may fulfil the role on the basis of a service contract with an external provider. The external DPO arrangement is common for organisations that cannot justify a full-time internal hire. Articles 38 and 39 must be satisfied regardless of the employment arrangement: the external DPO must have genuine independence, must not be subject to instructions, must have access to the organisation's processing activities and senior management, and must be protected against dismissal or penalty for performing their tasks. The service contract should reflect these requirements explicitly.

Does a US company with EU customers need to appoint a GDPR DPO?

A US company subject to GDPR under Article 3(2) must assess whether it meets the Article 37(1) triggers. If its core activities require large-scale regular and systematic monitoring of EU data subjects, as is common for advertising technology companies, data brokers, and large analytics platforms, Trigger Two applies and a DPO must be designated. If the US company's EU-facing activities are limited and involve neither large-scale systematic monitoring nor large-scale special-category data, no DPO is required, though a separate EU representative under Article 27 may still be mandatory. US companies should conduct and document the Article 37 assessment as part of their overall GDPR compliance programme.

Can the business owner or CEO serve as DPO?

In practice almost never. A CEO will usually have a conflict of interests under Article 38(6), because the CEO decides the purposes and means of the organisation's data processing, and the DPO's oversight function requires independence from that decision-making. WP243 rev.01 lists the chief executive first among senior management positions that may conflict, alongside the chief operating officer, chief financial officer, chief medical officer and the heads of marketing, HR and IT, and the Court of Justice held in X-FAB Dresden (C-453/21) that the question is decided case by case. A business owner who runs the company faces the same conflict, even in a small organisation. The solution for very small organisations is typically an external DPO service.

What are the penalties for not appointing a DPO when one is required?

Failure to appoint a required DPO is a violation subject to fines under Article 83(4), which covers obligations set out in Articles 25-39 and imposes fines of up to EUR 10 million or 2% of worldwide annual turnover, whichever is higher. Failure to publish the DPO's contact details under Article 37(7) is independently sanctionable. Supervisory authorities assess fines based on the nature, gravity, and duration of the violation, the intentional or negligent character of the breach, and the degree of cooperation. UK GDPR mirrors this structure, with the lower-tier maximum at GBP 8.7 million or 2% of global annual turnover.

What does a DPO actually do day to day?

A DPO's day-to-day activities flow from the five tasks in Article 39(1). They advise teams on whether a new product feature requires a DPIA and review the assessment once drafted. They audit records of processing activities under Article 30. They review data-processing agreements and standard contractual clauses before execution. They investigate data-subject rights requests and ensure responses are timely. They coordinate with IT and security following a personal data breach to determine whether Article 33 notification to the supervisory authority within 72 hours is required. They design and deliver staff training. They act as the single point of contact for the supervisory authority and ensure regulatory correspondence receives timely, accurate responses.

Does GDPR require a DPO for processors as well as controllers?

Yes. Article 37(1) applies to both controllers and processors. A data processor such as a cloud-services provider, a payroll-outsourcing company, or a marketing technology platform must appoint a DPO if its core activities as a processor meet the large-scale monitoring or large-scale special-category data triggers. The processor's DPO assessment focuses on its own core activities, not the activities of the controllers it serves. A cloud-infrastructure provider that hosts data on behalf of thousands of controllers and monitors network usage patterns at large scale may trigger Article 37(1)(b) independently of what its controller customers do with the data.

Can one DPO cover multiple companies?

Yes, in two scenarios. Article 37(2) allows a group of undertakings to designate a single DPO provided the DPO is easily accessible from each establishment. Article 37(3) allows multiple public authorities or bodies to designate a shared DPO, taking into account their organisational structure and size. The easy-accessibility requirement means the DPO must be reachable by employees, data subjects, and supervisory authorities at each entity without undue difficulty. The contact details of the shared DPO must be published by each entity under Article 37(7), and the DPO must have sufficient capacity to cover all entities' DPO tasks.

Is a DPO the same as a privacy officer or compliance officer?

Not necessarily. A DPO under GDPR is a specific statutory role with defined tasks under Article 39, a statutory independence guarantee under Article 38, and protection from dismissal. Many organisations have privacy officers or compliance officers whose job descriptions overlap with DPO functions, but those roles are not equivalent to a statutory DPO unless the person has been formally designated and their contact details published under Article 37(7). An organisation relying on an internal compliance officer without a formal designation has not met its Article 37 obligation. Equally, a formal designation alone is insufficient: the designated DPO must have the qualifications, resources, independence, and access that Articles 37 and 38 require.

What is the DPO's role in a data breach?

Article 39 does not list data-breach management as a standalone task, but the DPO's role flows from the monitoring and cooperation tasks in Article 39(1)(b), (d), and (e). In practice the DPO assesses whether a security incident constitutes a personal data breach under Article 4(12), determines whether it is likely to risk the rights and freedoms of data subjects, advises on whether Article 33 notification to the supervisory authority within 72 hours is required, advises on whether Article 34 notification to affected data subjects is needed, and acts as the supervisory authority contact throughout the investigation. The DPO should be involved from the moment a potential breach is identified, not after management has already made notification decisions.