Do we need a data protection officer?

GDPR requires a data protection officer in three situations, and only three. Article 37(1) names them: the processing is carried out by a public authority, the core activities involve regular and systematic monitoring of people on a large scale, or the core activities involve large-scale processing of special category data or criminal-offence data. Everything else in the question is detail hanging off those three.

There is no headcount in that test and no turnover figure. If someone has told you a business needs a DPO once it passes a certain size, that did not come from GDPR. What follows is what each part of the test actually means, so you can work out where your own processing sits.

What the law actually says

Article 37(1) says the controller and the processor shall designate a data protection officer in any case where:

• the processing is carried out by a public authority or body, except for courts acting in their judicial capacity
• the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale
• the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10

The "or" in that third limb is worth a note, because you will find copies of Article 37 that read "and" instead. The Regulation as first published in the Official Journal on 4 May 2016 did read "and", and a corrigendum published on 23 May 2018 at OJ L 127, page 2, replaced it with "or". The consolidated text linked above is the corrected one and flags that limb as amended. So large-scale processing of Article 9 data on its own engages the limb, and so does Article 10 data on its own.

Two of those limbs turn on terms with their own definitions. Article 9 is the special categories: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, plus genetic data, biometric data used to identify someone uniquely, data concerning health, and data concerning a person's sex life or sexual orientation. Article 10 is personal data relating to criminal convictions and offences.

Ireland's Data Protection Commission restates the same three limbs on its own page on who needs to appoint a DPO, and the UK's Information Commissioner's Office restates them for the UK GDPR in its guidance on data protection officers. The wording differs slightly between the three. The test does not.

What "core activities" means

This is where most people get stuck, because every business processes personal data and the phrase sounds like it could cover all of it.

It does not. The Article 29 Working Party guidelines on data protection officers, WP243 rev.01, are the working interpretation here: adopted in December 2016, revised in April 2017, and endorsed by the European Data Protection Board, which replaced the Working Party. They point to recital 97, which describes core activities as primary activities that do not relate to the processing of personal data as ancillary activities, and they read the phrase as the key operations necessary to achieve the controller's or processor's goals.

The guidelines then give the ancillary side directly. Paying your employees and running standard IT support are necessary, but they are support functions for the main business rather than the core activity itself. The ICO makes the same distinction and adds the case that catches people out: an HR services provider processes HR data as a core activity, because that is the service, while processing HR data about its own staff is ancillary.

The other direction matters too. The guidelines are explicit that core activities should not be read as excluding processing that forms an inextricable part of the activity. Their example is a hospital: its core activity is providing health care, it cannot do that safely without processing patient health records, so that processing is a core activity and hospitals must designate a DPO. A private security company doing surveillance of shopping centres and public spaces is the second example, for the same reason.

So the question is not whether you hold personal data. It is whether processing it is what the business is for.

What "large scale" means

GDPR does not define it, and the guidelines say plainly that it is not possible to give a precise number, either for the amount of data or for the number of individuals concerned, that would apply in all situations. They recommend weighing four factors instead:

• the number of data subjects concerned, either as a specific number or as a proportion of the relevant population
• the volume of data, and the range of different data items being processed
• the duration, or permanence, of the processing
• the geographical extent of the processing

The worked examples are more useful than the factors. The guidelines count as large scale: patient data processed by a hospital in the regular course of business, travel data from people using a city's public transport system, real-time geolocation of customers of an international fast food chain, customer data processed by an insurance company or a bank, behavioural advertising by a search engine, and content, traffic and location data handled by telephone or internet service providers.

They give two examples that do not count: patient data processed by an individual physician, and criminal-conviction data processed by an individual lawyer. Recital 91 says the same about the individual practitioner. Between those two ends, the guidelines acknowledge a large grey zone, and they note that a standard practice may develop over time for common processing activities. It has not been reduced to a number in the legislation.

What that usually adds up to

Most SMEs whose core business is not monitoring people at scale, and who are not handling health, biometric, criminal-offence or other Article 9 or Article 10 data at scale, will not be legally required to appoint a data protection officer. That is the general pattern in the test, not a ruling on your business: the three limbs turn on what your organisation actually does, and the only person who can hold them against your processing is someone who knows what that processing is.

It is worth being precise about what the honest answer to a procurement questionnaire looks like. If the form asks who your DPO is and the answer is that you do not have one, the useful version of that answer is not "nobody". It is that you looked at the three limbs of Article 37(1), and here is why none of them applies to what you do.

"Not required" is not the same as "nothing to do"

Not being required to appoint a DPO removes a role. It does not remove any of the obligations that role would have been watching.

Keeping a record of your processing activities (Article 30, which carries its own qualification for smaller organisations in Article 30(5), and is a separate question from this one), securing that processing (Article 32), reporting a breach within the deadlines (Articles 33 and 34) and answering people who exercise their rights (Articles 15 to 22) are not conditional on having designated anyone. The ICO puts it in one line: regardless of whether the UK GDPR obliges an organisation to appoint a DPO, it still has to have sufficient staff and resources to discharge its obligations under the regulation.

What changes when there is no DPO is not the amount of work. It is that nobody's job description says the work is theirs.

If you appoint one anyway

You can designate a DPO without being required to, and some businesses do because a customer or a procurement process expects a named one.

If you do, the rules come with the title. The guidelines are explicit: where an organisation designates a DPO on a voluntary basis, the requirements in Articles 37 to 39 apply to the designation, position and tasks as if it had been mandatory. The ICO says the same, that the same requirements of the position and tasks apply as if the appointment had been mandatory.

That is the part to know before adding three letters to someone's existing job title. Articles 38 and 39 carry requirements about independence, resourcing, reporting line and conflict of interest, and they apply to a voluntary appointment in full. Those requirements are a subject of their own and not this post.

Write down how you decided

If you work through the test and land on no, both sets of guidance point the same way: keep a note of the reasoning.

The Working Party guidelines recommend that, unless it is obvious that an organisation is not required to designate a DPO, controllers and processors document the internal analysis carried out to determine whether or not a DPO is to be appointed, so they can demonstrate that the relevant factors were taken into account properly. That analysis, the guidelines say, is part of the documentation under the accountability principle, it may be asked for by a supervisory authority, and it should be updated when necessary, for example if the organisation takes on new activities or offers new services that might fall within Article 37(1).

The ICO says it more briefly: if you decide that you do not need to appoint a DPO, either voluntarily or because you do not meet the criteria, it is a good idea to record this decision to help demonstrate compliance with the accountability principle.

Both are worded as recommendations rather than as obligations, and neither is presented as an obligation here. They are also cheap to follow. A note that says which limb of Article 37(1) you considered, what your core activities are, what the scale of your processing looks like against the four factors, who decided and on what date is a short document. The value of it is that the question does not have to be answered from memory the next time somebody asks.