EU GDPR, UK Data Protection Act 2018, and several Middle Eastern data protection laws state that, not all organisations require a data protection officer.
EU GDPR Article 37 states that a controller or processor are required to designate a data protection officer when:
the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences referred to in Article 10.
If the above does not apply, then the organisation can choose if they designate a data protection officer. In this case Datahub provide 6 data protection officer service plans that can support any organisation. These vary in services and cost but will provide all organisations with the assurance that they have an independent expert to advise.
For global organisations we would recommend a data protection officer with knowledge of the required laws. Datahub work with airlines that need to be compliant with multiple data protection laws and we have the experts that specialise in global data protection.
Find out more about our Data Protection Officer services.