Do You Need a Data Protection Officer? GDPR Articles 37 to 39 Explained

The three cases in Article 37(1)

A controller or processor must designate a data protection officer (DPO) where:

Case	Article
The processing is carried out by a public authority or body, except courts acting in their judicial capacity	37(1)(a)
Its core activities consist of processing operations which, by their nature, scope or purposes, require regular and systematic monitoring of people on a large scale	37(1)(b)
Its core activities consist of processing on a large scale of special categories of data (Article 9) or of personal data relating to criminal convictions and offences (Article 10)	37(1)(c)

Point (c) says special categories "and" criminal data, but the regulators' guidelines read it as "or": either kind of data at large scale is enough. The rule applies to controllers and processors separately, so a processor can need a DPO even when its customers do not.

What the key terms mean

The GDPR does not define these terms. The Article 29 Working Party's Guidelines on DPOs (WP243 rev.01), endorsed by the EDPB, explain how regulators read them.

Core activities

Core activities are the key operations needed to achieve your goals, including processing that is inextricably linked to them. A hospital's core activity is health care, but it cannot provide it without processing health records, so that processing is core. A security company that surveils shopping centres has surveillance as its core activity. Paying employees or running standard IT support are ancillary support functions, even though every organisation needs them.

Large scale

There is no number in the law. The guidelines list four factors: the number of people concerned, as a figure or as a share of the relevant population; the volume of data and range of data items; the duration or permanence of the processing; and its geographical extent.

Large scale, according to the guidelines' examples:

a hospital processing patient data in the regular course of business;
an insurer or bank processing customer data in the regular course of business;
a search engine processing personal data for behavioural advertising;
a telephone or internet service provider processing content, traffic or location data;
a city transport system tracking travel through travel cards.

Not large scale: an individual physician processing patient data, or an individual lawyer processing data on criminal convictions.

Regular and systematic monitoring

Monitoring includes all forms of tracking and profiling on the internet, but is not limited to it. Regular means ongoing, recurring or taking place at intervals; systematic means organised, methodical, or part of a general plan or strategy. The guidelines' examples include email retargeting, data-driven marketing, profiling and scoring for credit, insurance premiums or fraud prevention, location tracking by mobile apps, loyalty programmes, behavioural advertising, fitness and health monitoring through wearables, CCTV, and connected devices such as smart meters and smart cars.

Worked examples

Organisation	DPO required?	Why
A 15-person web shop that uses standard analytics and sends newsletters	Usually not	Selling goods is the core activity; the monitoring is not large scale
An adtech company profiling millions of users across websites	Yes, 37(1)(b)	Tracking and profiling is the core activity, on a large scale
A telehealth platform used by patients across several countries	Yes, 37(1)(c)	Large-scale processing of health data is inextricable from the service
A 200-person software company processing only its staff and B2B contact data	Usually not	HR and customer administration are ancillary, unless national law adds a duty
An analytics processor serving many small shops	Possibly yes, 37(1)(b)	Its processing for all customers together can be large-scale monitoring, even if each shop's is not

These follow the reasoning of the guidelines; your own answer depends on your facts.

Write the decision down: the guidelines recommend documenting your analysis of whether a DPO is needed, as part of accountability, and updating it when you start new activities. A one-page note is enough.

National rules can require more

Under Article 37(4), EU or national law can require a DPO in other cases. Germany is the best-known example: Section 38(1) of the Federal Data Protection Act (BDSG) requires private bodies to designate one if they constantly employ, as a rule, at least 20 persons dealing with the automated processing of personal data, and regardless of headcount if they carry out processing that needs a DPIA or process data commercially for transfer or market research. The federal and state governments' modernisation agenda of 4 December 2025 says the federal government will propose repealing Section 38(1) by 31 December 2026, which would leave only the GDPR test. Until a repeal is adopted, the 20-person rule applies. Check your own country's law.

Who can be your DPO

Expertise: the DPO is designated on the basis of professional qualities, in particular expert knowledge of data protection law and practice (Article 37(5)). The level needed depends on how sensitive and complex your processing is.
Staff or external: the DPO can be an employee or work under a service contract (Article 37(6)). A group of companies can share one DPO if the DPO is easily accessible from each establishment (Article 37(2)).
Location: the guidelines recommend a DPO located in the EU, so that people and authorities can reach them.
Contact details: publish them, for example in your privacy notice, and communicate them to your supervisory authority (Article 37(7)).

Independence and conflicts of interest

The DPO must be involved properly and in good time in all data protection issues, be given the resources to do the job, receive no instructions on how to perform their tasks, and report directly to the highest management level (Article 38(1) to (3)). They cannot be dismissed or penalised for performing their tasks.

A DPO may have other duties, but they must not create a conflict of interests (Article 38(6)). In X-FAB (C-453/21, 9 February 2023), the Court of Justice held that a conflict may exist where other tasks lead the DPO to determine the purposes and means of processing, to be assessed case by case. The guidelines name typical conflicting roles: chief executive, chief operating, financial or medical officer, and heads of marketing, HR or IT.

The Court also held, in Leistritz (C-534/20, 22 June 2022) and again in X-FAB, that national law may give staff DPOs stronger protection against dismissal, allowing it only for just cause, as long as this does not undermine the GDPR's objectives.

What the DPO does

Article 39(1) sets the minimum tasks:

Inform and advise the organisation and its staff about their data protection obligations.
Monitor compliance with the GDPR and internal policies, including responsibilities, awareness-raising, training and audits.
Advise on data protection impact assessments and monitor their performance, where requested (see our DPIA guide).
Cooperate with the supervisory authority.
Act as the contact point for the authority, including on prior consultation under Article 36.

People can also contact the DPO about their data and rights (Article 38(4)). The DPO is not personally responsible for compliance: that stays with the controller or processor (Article 24), which is why the role is advisory and independent.

If you do not need a DPO

You can still appoint one voluntarily, but then Articles 37 to 39 apply in full, including independence and the protection against dismissal. Many small companies instead name a privacy lead or contact point; the guidelines advise making clear, internally and externally, that this person is not a DPO. Either way, someone must own your records of processing, DPIAs and breach handling.

Give your DPO, or your privacy lead, the paperwork. The Privacy Impact Assessment Bundle includes a DPO consultation record, a DPIA screening checklist, a DPIA template and register, a data protection by design checklist and a transfer impact assessment.