The obligation to have a DPO is imposed on companies that process personal data on a large scale, handle sensitive data, or are public authorities.