The GDPR dictates that you must appoint a DPO if you are a public authority or body, or if you carry out certain types of processing activities such as regular and systematic monitoring of individuals, or large-scale processing of sensitive data.
Although other organizations are not legally required to have a DPO, the ICO recommends every organization appoints a DPO to comply with the GDPR, manage data protection and avoid fines.