Do you need a data protection officer? The three triggers in Article 37

You must designate a data protection officer (DPO) in three cases set out in GDPR Article 37(1): you are a public authority or body; your core activities involve regular and systematic monitoring of people on a large scale; or your core activities involve large-scale processing of special category data (health, biometrics, religion and the others in Article 9) or of criminal conviction data. Member State law can add more cases, and Germany does.

Most small businesses do not meet any of the three triggers. But the European data protection authorities recommend that you document the analysis, even when the answer is no. This guide explains each trigger in plain language, with the official examples. It is general information, not legal advice.

#What does Article 37 say?

Article 37(1) of the GDPR says the controller and the processor "shall designate a data protection officer in any case where":

• (a) the processing is carried out by a public authority or body, except courts acting in their judicial capacity;
• (b) the core activities of the controller or processor consist of processing operations which, by their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale;
• (c) the core activities consist of processing on a large scale of special categories of data (Article 9) or of personal data relating to criminal convictions and offences (Article 10).

The rest of the article covers the practical side. A group of companies may share one DPO if that person is "easily accessible" from each establishment (37(2)). The DPO is chosen for professional qualities, in particular expert knowledge of data protection law and practice (37(5)). The DPO can be an employee or work under a service contract (37(6)). And you must publish the DPO's contact details and communicate them to the supervisory authority (37(7)).

Article 37(4) adds that, outside these cases, you may designate a DPO voluntarily, and must do so where EU or national law requires it.

#What do "core activities", "large scale" and "regular and systematic monitoring" mean?

The words come from the regulation, but the explanations come from the Article 29 Working Party's Guidelines on Data Protection Officers (WP243 rev.01, adopted on 13 December 2016 and last revised on 5 April 2017). The European Data Protection Board (EDPB) endorsed these guidelines, and they remain the reference.

The guidelines list examples of regular and systematic monitoring: operating a telecoms network, email retargeting, data-driven marketing, profiling and scoring for risk assessment (credit scoring, insurance premiums, fraud prevention, anti-money-laundering), location tracking by mobile apps, loyalty programmes, behavioural advertising, wearable health and fitness tracking, CCTV and connected devices such as smart meters and smart cars.

The EDPB's guide for small businesses adds that monitoring "includes all forms of tracking and profiling on the internet", including behavioural advertising, but is not limited to the online world.

Two points matter for small companies. First, all three conditions in trigger (b) must be met together: the monitoring must be a core activity, regular and systematic, and large scale. Second, the guidelines do not give a number for "large scale". You have to weigh the four factors yourself, and the decision depends on your sector.

#Are there national rules on top of Article 37?

Yes. Article 37(4) lets EU or Member State law require a DPO in more cases. The best-known example is Germany.

As of 7 November 2026, section 38(1) of the German Federal Data Protection Act (BDSG) requires private companies to designate a DPO if, as a rule, at least 20 persons are constantly engaged in the automated processing of personal data. It also requires one, whatever the headcount, if the company carries out processing that needs a DPIA under Article 35, or processes personal data commercially for transfer, anonymised transfer, or market or opinion research.

So a German agency with 25 staff who all work with customer data in their daily tools may need a DPO, even though the same company in France or Ireland may not. If you have establishments in several countries, check each national law. Your regulator's website is the best place to start.

#Do processors need a DPO too?

Article 37 applies to controllers and processors alike. Each one must check the triggers against its own activities. The WP243 guidelines note that a controller may need a DPO while its processor does not, and the reverse. For example, a small software company that hosts large volumes of health data for clinics may meet trigger (c) as a processor, even if each clinic is small.

The guidelines add that designating a DPO at the processor can be good practice even when it is not required.

#Small-business examples: who needs one?

These are illustrations based on the WP243 examples, not decisions. Your own facts decide.

#What must a DPO be able to do?

A DPO is not just a contact name. Article 38 and Article 39 give the role tasks and protections.

Tasks (Article 39): inform and advise the company and its staff on their obligations; monitor compliance, including training and audits; give advice on DPIAs when asked and monitor how they are carried out; cooperate with the supervisory authority and act as its contact point.

Position (Article 38):

• involved "properly and in a timely manner" in all data protection issues;
• given the resources and access to data and processing they need;
• receives no instructions on how to perform these tasks, and cannot be dismissed or penalised for performing them;
• reports directly to the highest management level;
• can be contacted by people about their data and their rights;
• may have other duties, but they must not create a conflict of interests.

On conflicts, the guidelines say the DPO cannot hold a position that leads them to decide the purposes and means of processing. They cite senior management roles (chief executive, chief operating, chief financial or chief medical officer) and say other roles, such as the heads of marketing, HR or IT, can conflict too. The Court of Justice confirmed in X-FAB Dresden (C-453/21, 9 February 2023) that a conflict may arise where other duties lead the DPO to determine purposes and means, to be assessed case by case. In practice, a small company's founder or CEO is usually not a suitable DPO.

The guidelines also stress that DPOs are not personally responsible for non-compliance. Compliance remains the company's responsibility.

#Internal or external DPO?

Both are allowed (Article 37(6)). An external DPO works under a service contract, either as an individual or through a firm. The EDPB says that if the contract is with a firm, each person in the team must meet the same conditions, including freedom from conflicts.

#What about the "privacy contact" you already have?

If you are not required to have a DPO, you can still name a person who handles privacy questions. The guidelines are clear on two points. If you designate a DPO voluntarily, the Article 37 to 39 rules apply as if the designation were mandatory, including independence and the duty to notify the regulator. And if the person is not a DPO, their title should not say so, internally or publicly. A neutral title such as "privacy lead" or "privacy contact" avoids the confusion.

In Privacyboard, the company profile has an optional field for the person in charge of personal data, where you say whether they are a designated DPO or simply your privacy contact; your privacy policy uses it.

#How do you designate a DPO with the regulator?

Article 37(7) requires two steps: publish the contact details (for example in your privacy policy and privacy center) and communicate them to your supervisory authority. Each authority has its own form. In France, for example, the CNIL accepts designations, replacements and the end of a mission only through its online service. According to the WP243 guidelines, the published details do not have to include the DPO's name, though the regulator needs it, and people must be able to reach the DPO directly.

#Checklist: deciding whether you need a DPO

• List your core activities: what you sell or deliver, not your support functions.
• Check trigger (a): are you a public authority or body?
• Check trigger (b): does a core activity track or profile people regularly and systematically? Is it large scale under the four factors?
• Check trigger (c): does a core activity process health, biometric, genetic or other Article 9 data, or criminal data, at scale?
• Do the same check for activities you run as a processor for clients.
• Check the national law of each country where you are established (for example section 38 BDSG in Germany).
• Write down the outcome and the reasons, and date it.
• If you need a DPO: choose for expertise, check conflicts, give them resources and a direct line to management.
• Publish the DPO's contact details and send them to your regulator.
• Review the decision when you launch a new product, enter a new country or grow your team.

#What do regulators find in practice?

In the course of 2023, 25 data protection authorities across the European Economic Area, including the European Data Protection Supervisor, looked at DPOs in a coordinated action. The EDPB adopted the report on 17 January 2024, based on more than 17,000 replies. It found organisations that had not designated a DPO where it was mandatory, DPOs without enough resources or expert knowledge, and DPOs who lacked independence or did not report to top management. It also found that most DPOs had clear tasks and received no instructions on how to do them.

#Is anything changing?

As of 7 November 2026, Articles 37 to 39 apply as written. The European Commission's "Digital Omnibus" proposal to amend the GDPR is still being negotiated and is not law. Check your regulator's website before you rely on any proposed change.

#FAQ

#Is a DPO mandatory for every company?

No. Under the GDPR, only the three cases in Article 37(1) make it mandatory, plus any case national law adds. Many small businesses need none. Keep a short written record of how you reached that conclusion.

#Does the number of employees matter?

Not under the GDPR itself: the triggers depend on what you do with data, not on headcount. Some national laws do use headcount. In Germany, section 38 BDSG uses the threshold of at least 20 persons constantly engaged in automated processing.

#Can the CEO or founder be the DPO?

Usually not. The guidelines name the chief executive and other senior managers as roles that conflict with the DPO's independence, because they decide how data is used. The Court of Justice says conflicts are assessed case by case.

#Can one DPO serve several companies?

Yes. A group of companies can share one DPO if that person is easily accessible from each establishment, and external DPOs often serve several clients under separate contracts.

#Is a DPO personally liable if the company breaks the GDPR?

No. The WP243 guidelines state that data protection compliance is a corporate responsibility of the controller or processor, not of the DPO.

#Is a DPO the same as an EU representative?

No. An EU representative under Article 27 is needed by some companies established outside the EU. A DPO is an internal or contracted advisor with monitoring tasks. A company may need one, both or neither.

#Sources

• Regulation (EU) 2016/679 (GDPR), Articles 37, 38 and 39, EUR-Lex
• Article 29 Working Party, Guidelines on Data Protection Officers (WP243 rev.01), adopted 13 December 2016, last revised 5 April 2017
• EDPB, Endorsed WP29 Guidelines
• EDPB, Data protection guide for small business: Data Protection Officer
• EDPB, Coordinated Enforcement Action, Designation and Position of Data Protection Officers, adopted 17 January 2024
• Court of Justice of the EU, X-FAB Dresden, C-453/21, judgment of 9 February 2023, EUR-Lex
• Bundesdatenschutzgesetz (BDSG), section 38, gesetze-im-internet.de
• CNIL, Désigner un délégué à la protection des données (DPO) ou modifier une désignation