Companies in which at least twenty employees process personal data are generally required to appoint a Data Protection Officer. Regardless of the number of employees, this obligation to appoint also applies to companies that process special categories of personal data (e.g., health data) or if the core activity of the company involves the collection, processing, use, or transmission of personal data.