Source: https://uodo.gov.pl/en/561/901
Timestamp: 2019-04-25 01:51:43+00:00

Document:
Who can and who does not have to designate a DPO?
Public authorities or bodies obliged to designate a DPO, referred to in Art. 37 para. 1 letter a of the GDPR, shall mean public finance sector entities (e.g. territorial self-government entities, public education institutions), research institutes and the National Bank of Poland (Narodowy Bank Polski) (Art. 9 of the Act of 10 May 2018 on Personal Data Protection).
core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale.
In the interpretation of the notions used in Art. 37 para. 1 letters b and c of the GDPR („core activities”, „regular and systematic monitoring” and „on a large scale”) the recitals of the GDPR and Article 29 Working Party’s Guidelines on Data Protection Officers may be useful.
In other cases designation of a DPO is optional. However, even in the situation where the requirement to designate a DPO does not result from the provisions, the Article 29 Working Party in its Guidelines on Data Protection Officers recommends controllers and processors to document the internal procedure carried out in order to establish and consider particular conditions from Art. 37 para 1 of the GDPR of the existence or lack of this obligation.
Pursuant to Art. 37 para. 5 of the GDPR the data protection officer shall be designated on the basis of professional qualities and, in particular, expert knowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39. The level of DPO’s knowledge shall be determined in the context of particular needs of the controller and the processor (recital 97 of the GDPR). As indicated by the Art. 29 Working Party, the required level of expertise is not strictly defined but it must be commensurate with the sensitivity, complexity and amount of data an organisation processes. The DPO should thus be chosen carefully, with due regard to the data protection issues that arise within the organisation.
Personal qualities of a DPO qualifying him or her to fulfil this function should include integrity and high professional ethics.
Pursuant to Art. 37 para. 6 of the GDPR both the controller’s or processor’s employee and a person not being an employee of the above mentioned entities (outsourcing).

References: Art. 37
 Art. 37
 Art. 37
 Art. 37
 Art. 29
 Art. 37