Question: a data protection officer (dpo) must be appointed?
Answer: The GDPR introduces a duty for you to appoint a data protection officer (DPO) if you are a public authority or body, or if you carry out certain types of processing activities. ... The DPO must be independent, an expert in data protection, adequately resourced, and report to the highest management level.