Under the UK GDPR, an organisation must appoint a DPO if it’s a public authority, its core activities involve large scale data processing that requires regular and systematic monitoring of individuals, or if its core activities consist of large-scale processing of special categories of data or data relating to criminal convictions and offences. Although there is not a legal requirement to hire a DPO once a certain number of employees is reached, many companies still opt to appoint a DPO in order to deal with complex privacy requirements.