GDPR, EU & AI Compliance
Ask a company whether it needs a DPO, and you'll often hear a headcount. Article 37 of the GDPR doesn't contain one.
What it contains is three cases and a judgment about what your company actually does. When that judgment goes from "not yet" to "yes," a set of specific things changes. Some are legal obligations. Others are decisions about who sits where in the organization.
Article 37(1) requires a controller or a processor to designate a DPO in three cases. The first is processing carried out by a public authority or body, except courts acting in their judicial capacity. The second is where the core activities consist of processing that requires regular and systematic monitoring of individuals on a large scale. The third is where the core activities consist of large-scale processing of special categories of data or criminal offence data.
Three terms carry the weight. "Core activities" means the key operations needed to achieve your goals, not supporting functions. A bank's core activity involves its customers' financial data, while processing its own employees' payroll data is ancillary. "Large scale" has no number. The Article 29 Working Party's DPO guidelines, endorsed by the EDPB, point to four factors: how many people are affected, the volume and range of data, how long the processing lasts, and its geographical extent. And "regular and systematic monitoring" covers activities such as behavioral advertising, data-driven marketing, and profiling and scoring for risk assessment.
The guidelines give examples in both directions. A hospital processing patient data is large scale. An individual physician is not. An individual lawyer handling criminal offence data is not.
For a software company, the live question is usually whether tracking or profiling of end users is a core activity rather than a side effect of running the product. That is our read of where the judgment tends to land, not a rule.
Because there is no number, the guidelines recommend documenting the analysis whenever the answer isn't obvious. GDPR doesn't prescribe a standard "no DPO" form, but a documented analysis is strong evidence of accountability if the answer is ever questioned, and it's something to revisit if the processing changes.
You designate someone. Both controllers and processors must. A group of companies can share one DPO, as long as that person is easily accessible from each establishment. The DPO needs expert knowledge of data protection law and practice, and can be an employee or an outside provider under a service contract.
The DPO gets properly involved, not just protected. Under Article 38, the organization has to involve the DPO properly and in a timely manner in every issue that touches personal data, and support them with the resources, access, and training the role needs. On top of that, the DPO can't be instructed on how to do the job, can't be dismissed or penalized for doing it, and reports directly to the highest level of management. Other duties are allowed only where they don't create a conflict of interest.
Their contact details go public. The DPO's contact details are published and communicated to the supervisory authority, and data subjects are given a way to reach them, usually through the privacy notice. That doesn't require publishing the DPO's personal name; a role-based contact route is enough.
The DPO gets a defined set of tasks. Article 39 includes advising the company, monitoring compliance, training, advising on DPIAs, and acting as the contact point for the authority. Where a DPO is designated, Article 35(2) requires the controller to seek their advice when carrying out a DPIA, and the EDPB's new DPIA template has a section for recording their involvement.
The fine tier applies. Articles 37 to 39 sit in the lower fine tier: up to €10 million or 2 percent of worldwide annual turnover, whichever is higher.
The EDPB's 2023 coordinated action on DPOs involved 25 authorities and 17,490 responses from organizations and DPOs. Its report, adopted in January 2024, identified problems including failure to designate a DPO at all, insufficient resources, insufficient expertise, tasks that weren't fully assigned to the DPO, conflicts of interest, insufficient independence, and DPOs who didn't report directly to the highest level of management.
A well-known enforcement example is Proximus. In a decision dated 28 April 2020, the Belgian authority fined the telecom operator €50,000 because its DPO also headed its compliance, risk management, and audit departments. The authority's reasoning was that a person running those departments determines how data is processed in them and so can't independently supervise them. It found the problem while investigating a self-reported breach, and the breach itself wasn't sanctioned. It is a small fine, and it is a 2020 decision. What it shows is where authorities look: the structure around the DPO, not just whether the title exists.
If you have a German establishment, section 38 of the Federal Data Protection Act adds a second test. It requires a DPO where at least 20 people are constantly engaged in automated processing of personal data, and regardless of headcount where processing requires a DPIA or is done commercially for transfer or for market or opinion research. The threshold rose from 10 to 20 in 2019.
In December 2025, the German government announced that it intends to repeal the 20-person rule by the end of 2026. As of the sources we could find, no draft bill exists, and the rule remains in force. Article 37 itself isn't affected.
The gaps are structural. A DPO who is designated on paper and reports to the head of a department. Contact details that were never published. A DPO who learns about a new tool after it launched. A DPIA with no record of who was consulted. Each of those is visible to anyone who asks to see the documents.
There are three routes. Hire and designate an employee. Designate someone already inside, with a documented conflict analysis. Or appoint an outside DPO under a service contract. At a certain scale, an in-house DPO makes more sense, and 1bigthink will say so if that applies.
Setting up the reporting line and the published contact details is part of getting the role in place, and you review it. 1bigthink is not a law firm, so privilege doesn't attach to this work, and your outside counsel stays your counsel.
When it is a public body (except courts acting in their judicial capacity), or when its core activities involve regular and systematic monitoring of individuals on a large scale, or large-scale processing of special category or criminal offence data. There is no headcount threshold in the GDPR itself. Some member states, such as Germany, add their own.
The key operations necessary to achieve your goals, as opposed to supporting functions. A bank's core activity involves customer financial data, while paying its own employees is ancillary. Whether user tracking is core to a software product is a judgment worth documenting.
If GDPR applies to it and it meets one of the Article 37 triggers, yes. Being based outside the EU doesn't change the test. Whether GDPR applies at all depends on the establishment and targeting tests, which is a separate question worth settling first.
Yes. The DPO can be a member of staff or work under a service contract. Either way the DPO must be properly involved and resourced, independent, able to report directly to top management, and free of conflicting duties.
