Does Every Organisation Need a Dpo?

Answer. Your company/organisation needs to appoint a DPO, whether it's a controller or a processor, if its core activities involve processing of sensitive data on a large scale or involve large scale, regular and systematic monitoring of individuals. ... A DPO can be an individual or an organisation.

Is DPO mandatory under GDPR?

Mandatory appointment

Under the GDPR, appointing a DPO is mandatory under three circumstances: The organisation is a public authority or body. The organisation's core activities consist of data processing operations that require regular and systematic monitoring of data subjects on a large scale.

Is a DPO required for small organisation?

There will be plenty of SMEs (small and medium-sized enterprises) that don't fit into any of these categories, so they aren't required to appoint a DPO. ... There are many benefits to having a DPO, and in 2017, the WP29 (Article 29 Working Party) recommended that all organisations appoint one as a matter of best practice.