No, not necessarily. Although an early draft of the GDPR specified that the exact number of 250 employees was the trigger for whether or not you need a DPO, the final regulation does unfortunately not have quite as clear guidelines for this. DPOs are mandatory for all public authorities, for organizations that conduct large-scale processing of special categories of personal data (such as health data), and where the core activities of a business involve "regular and systematic monitoring of data subjects on a large scale". Most large retailers fall under this definition. If you are unsure whether or not this applies to you, we suggest you seek legal advice.