Does every company need a Data Protection Officer?

No. Article 37 requires a DPO only for public authorities, organisations whose core activities involve large-scale systematic monitoring, or those whose core activities involve large-scale special-category or criminal-offence data. Most small businesses can appoint one voluntarily but are not obliged to.

Can the DPO be an existing employee?

Yes, provided the role does not create a conflict of interest. A DPO cannot also be someone who decides the purposes and means of processing — so a CEO, CIO or head of marketing generally should not hold the role.

What does a DPO actually do?

They advise on GDPR obligations, monitor compliance, provide staff training, advise on DPIAs, and act as the point of contact for data subjects and the supervisory authority — all while operating independently.

What is Data Protection Officer (DPO)?

A Data Protection Officer (DPO) is an independent expert who advises an organisation on GDPR compliance, monitors it, trains staff, and acts as the contact point for individuals and the supervisory authority. Under Article 37, appointing one is mandatory in three cases; many other organisations appoint a DPO voluntarily.

The DPO's job is to oversee data-protection compliance without conflict of interest — they report to the highest level of management and cannot be penalised for doing their job. Article 37(1) makes appointment mandatory only in three situations: the organisation is a public authority; its core activities involve large-scale, regular and systematic monitoring of individuals; or its core activities involve large-scale processing of special-category or criminal-offence data.

So most ordinary small businesses are not legally required to appoint a DPO, though many designate a privacy lead voluntarily to coordinate obligations. For example, a hospital network or an ad-tech company tracking users at scale would need one; a typical local retailer generally would not.

A documented DPO role description, responsibilities, and reporting line make the appointment defensible and give the person a clear mandate. The template defines the role — but effective data protection depends on the DPO's actual independence, competence, and the authority the organisation gives them to act.

Frequently asked questions

Does every company need a Data Protection Officer?: No. Article 37 requires a DPO only for public authorities, organisations whose core activities involve large-scale systematic monitoring, or those whose core activities involve large-scale special-category or criminal-offence data. Most small businesses can appoint one voluntarily but are not obliged to.
Can the DPO be an existing employee?: Yes, provided the role does not create a conflict of interest. A DPO cannot also be someone who decides the purposes and means of processing — so a CEO, CIO or head of marketing generally should not hold the role.
What does a DPO actually do?: They advise on GDPR obligations, monitor compliance, provide staff training, advise on DPIAs, and act as the point of contact for data subjects and the supervisory authority — all while operating independently.

Toolkits that cover Data Protection Officer (DPO)

EU GDPR

GDPR Compliance Pack for Small Business

14 editable GDPR documents — privacy notices, DSAR procedure, DPIA, breach response, processor DPA checklist — plus a pre-filled Records of Processing Activities (Art. 30) workbook and evidence checklist.

$7930% off with codeView toolkit

Learn more in our GDPR guide, explore the editable policy templates, or browse the full compliance glossary.

← Back to the compliance glossary