A typical case of an international data transfer would be the use of cookies on a company’s website: Since many providers have their servers located outside the EU, the data collected by the cookies are sent to the servers and are therefore transferred to a third country. Furthermore, centralized company functions, for example “group IT” based in the USA, lead to international data transfers.
It is mandatory to appoint a DPO:
where the processing is carried out by a public authority or body,
where the core activity of the controller or processor is to carry out processing operations which, by their nature, scale and/or purposes, require extensive, regular and systematic supervision of data subjects, or
where the core activity of the controller or processor is the processing on a large scale of special categories of data as referred to in Art. 9 GDPR or of personal data relating to criminal convictions and offences as referred to in Art. 10 GDPR. For example in Germany, according to § 38 Federal Data Protection Act (BDSG), a DPO must be appointed if:
as a general rule, at least 20 persons are permanently involved in the automated processing of personal data,
the controller or the processor is subject to a DPIA pursuant to Art. 35 GDPR, or
personal data are processed for the purpose of transmission, anonymous transmission or for purposes of market and opinion research.