“We're too small to be affected.” It's the line you hear most often about the data protection officer. It is almost always wrong, not because the company is required to appoint one, but because size is never the right criterion.
The GDPR sets no threshold for employees, customers or revenue. It looks at one thing only: what you do with personal data. Three situations make appointing a DPO mandatory.
Case 1: You are a public body
Public authorities and bodies must appoint a DPO, whatever the volume of data they process. It's the easiest case to spot: the criterion depends neither on headcount nor on the type of activity.
Case 2: You track people on a large scale
If the core of your business involves regularly and systematically monitoring individuals on a large scale, a DPO becomes mandatory. In practice, that means online tracking, behavioral profiling, geolocation, targeted advertising, scoring, fraud prevention, connected devices.
“Large scale” is not measured by a magic number. You assess together the number of people concerned, the volume and variety of the data, the duration of the processing and its geographic reach.
A seemingly “support” activity becomes a core activity as soon as it is precisely the service you sell.
Case 3: You process sensitive data on a large scale
Health data, biometrics, opinions, trade union membership, sexual orientation, offenses and convictions: if you process these categories on a large scale and they sit at the heart of your business, appointing a DPO is required. The level of expertise and security expected goes up a notch.
Outside these cases: optional, but rarely neutral
If none of the three cases applies, you are not required to appoint one. Many companies still choose to appoint a voluntary DPO, because their processing is extensive, complex or sensitive. One point is little known: a voluntary DPO falls under the same regime as a mandatory one: independence, resources, no conflict of interest, regulatory duties. You don't appoint a DPO “for show.”
The real obligation is to have thought it through
Even when the answer is “no,” the GDPR expects you to be able to demonstrate it. Good practice fits on one page: a dated note describing your activities, your categories of data, your tracking mechanisms and your volumes, and concluding on whether the obligation applies or not.
This note should be reviewed after every change of scale: an acquisition, a new digital product, an AI platform, a centralization of data, an international expansion. On the day of an inspection, it is what proves you did not ignore the question.
One question, before anything else
Ask yourself one question before anything else: is tracking people or processing sensitive data at the core of my business, on a large scale? If so, appointing a DPO is not optional. If not, put it in writing, date it, and file the note with your compliance records.
The right question is not “am I big enough?” but “what am I really doing with the data I collect?”
