Enterprises engaged in economic commerce that do systematic and large-scale data processing need to appoint a data protection officer (DPO) to strategize and enforce the GDPR compliance. The requirement for a DPO  is not dependent on business size or employee headcount.