Under the General Data Protection Regulation (GDPR), a company must appoint a Data Protection Officer (DPO) if it meets any of the following criteria:
The company processes personal data on a large scale, either as a core activity or as part of its core activities.
The company processes sensitive data on a large scale, either as a core activity or as part of its core activities.
The company engages in systematic monitoring of individuals, either as a core activity or as part of its core activities.
The company is a public authority or body, except for courts acting in their judicial capacity.
Even if a company is not required by law to appoint a DPO, it may choose to do so voluntarily in order to demonstrate its commitment to data protection and to ensure that it complies with relevant data protection regulations.