Data Protection Officer: Do You Need One?

Key Takeaways

Point	Summary
DPO required when	Public authority, large-scale monitoring of individuals, large-scale special category data processing
Most startups	DPO not mandatory, but someone should be responsible for data protection
DPO role	Advise on compliance, monitor practices, liaise with authorities, train staff
Independence required	DPO must not have conflicts of interest; cannot be dismissed for doing their job
Outsourced DPO option	Can use external DPO service if requirements are met

Quick Answer: Most startups don't legally need a DPO. You need one if you: are a public authority, do large-scale systematic monitoring, or process special category data at scale. Even if not required, designate someone responsible for data protection.

When is a DPO Required?

GDPR mandates a DPO in three scenarios:

Scenario 1: Public Authority

• You are a public body or government agency (except courts acting in judicial capacity) → DPO Required

Scenario 2: Core Activity - Large Scale Monitoring

• Your core activities require regular and systematic monitoring of individuals on a large scale → DPO Required

Scenario 3: Core Activity - Special Category Data

• Your core activities involve large-scale processing of special category data or criminal records → DPO Required

None of the above?

• DPO Not Mandatory (but may be recommended)

Understanding the Criteria

"Core Activities"

Core activities are the main business operations, not supporting functions.

Core Activity Examples	Supporting Function Examples
E-commerce sales	Employee payroll
Healthcare services	IT support
Marketing services	Legal department
Security monitoring	Office administration

Key question: Would your business exist without this activity?

"Large Scale"

GDPR doesn't define exact thresholds. Consider:

Factor	Considerations
Number of Data Subjects	Thousands vs. hundreds
Volume of Data	Amount per person
Duration	Ongoing vs. one-time
Geographic Scope	Local vs. international

"Regular and Systematic Monitoring"

"Regular" Means	"Systematic" Means
Ongoing or recurring	Following a plan
At specified intervals	Organized method
Continuous	Pre-arranged approach

Examples of regular and systematic monitoring:

• Behavioral advertising networks
• Loyalty/reward programs
• Fitness/health tracking apps
• Location tracking services
• Credit scoring
• CCTV surveillance

"Special Category Data"

Processing on a large scale of:

• Racial or ethnic origin
• Political opinions
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data for identification
• Health data
• Sex life or sexual orientation
• Criminal convictions and offenses

Do Startups Need a DPO?

Most early-stage startups don't require a formal DPO, but consider your situation:

Business Type	DPO Typically Required?
Generic B2B SaaS	No
E-commerce	No
Basic marketing platform	No
Healthcare app	Often yes
HR/recruitment platform	Often yes
Adtech/behavioral tracking	Often yes
Security/surveillance	Often yes
Financial services	Sometimes

Even without a formal DPO requirement, someone should own privacy responsibilities.

DPO Responsibilities

If you need (or choose to have) a DPO, their duties include:

Inform and Advise:

• Brief controller on GDPR obligations
• Advise on data protection matters
• Recommend policies and procedures
• Guide on privacy impact assessments

Monitor Compliance:

• Audit data protection practices
• Monitor compliance with GDPR
• Monitor compliance with internal policies
• Track training and awareness

Cooperate with Authority:

• Contact point for supervisory authorities
• Facilitate authority inquiries
• Support regulatory communications
• Handle breach notifications

Contact Point:

• Accessible to data subjects
• Handle privacy inquiries
• Support data subject requests
• Available to employees

DPO Independence Requirements

If you appoint a DPO, GDPR requires:

Requirement	Meaning
Direct Reporting	Report to highest management level
No Instructions	Cannot be told how to perform tasks
No Dismissal	Cannot be dismissed for performing duties
No Conflict	Cannot hold conflicting positions
Adequate Resources	Must have sufficient time and tools
Access	Must have access to all necessary information

Positions That Conflict with DPO

The DPO cannot hold a position that determines the purposes and means of personal data processing. Common conflicting roles include:

• CEO, COO, CFO, CMO, CTO
• Head of IT
• Head of HR
• Head of Marketing

Why? These roles make decisions about data processing that the DPO should independently review.

Legal Counsel - Case-by-Case Assessment:

Whether legal counsel conflicts with the DPO role depends on the specific duties involved:

Scenario	Typically Conflicts?	Reasoning
In-house counsel advising management on processing purposes	Yes	Directly influences what data is processed and why
In-house counsel handling routine legal matters	Assess case-by-case	Depends on involvement in processing decisions
External counsel providing legal advice	No	Advisory role without decision-making authority

Per EDPB Guidelines on DPOs (Article 38(6)), the assessment should focus on whether the role involves determining purposes and means of processing, not the job title itself.

DPO Options

Option 1: Internal DPO

An employee designated as DPO.

Pros	Cons
Deep business knowledge	May lack expertise
Always available	Requires training
Understands culture	Time commitment
Lower ongoing cost	Independence challenges

Requirements:

• Expert knowledge of data protection law
• Ability to fulfill tasks
• Professional qualities
• Sufficient time allocation

Option 2: External DPO

A third party providing DPO services.

Pros	Cons
Expert knowledge	Higher cost
Independence	Less business context
No training needed	Availability limits
Flexible arrangement	Relationship building

Requirements:

• Same expertise requirements
• Accessible and available
• No conflicts of interest
• Clear contract defining responsibilities

Option 3: Shared DPO

One DPO serving multiple organizations.

When Appropriate	Considerations
Group companies	Must be accessible to all
Small organizations	Clear allocation of time
Similar processing	No conflicts between organizations

Privacy Champion / Privacy Lead

Even without a required DPO, designate someone responsible for privacy:

Responsibilities:

• Own privacy policy and procedures
• Coordinate DSAR responses
• Manage vendor privacy reviews
• Handle privacy incidents
• Support product privacy features
• Maintain compliance documentation

Unlike DPO:

• No formal independence requirement
• Can have other responsibilities
• Doesn't need to be expert
• Reports through normal channels
• Less formal requirements

Best Practices:

• Allocate dedicated time (20-50%)
• Provide training
• Give access to information
• Support with resources
• Ensure management backing

DPO Contact Information

If you have a DPO, you must:

• Publish their contact details
• Communicate details to your supervisory authority
• Make them accessible to data subjects

Note: You can provide role-based contact (e.g., dpo@company.com) rather than personal name.

Self-Assessment Checklist

Do you need a DPO?

• Are you a public authority? → DPO required
• Do your core activities involve large-scale monitoring of individuals? → DPO required
• Do you process special category data on a large scale as a core activity? → DPO required
• Do you process criminal conviction data on a large scale? → DPO required

If no DPO required, do you have:

• Someone responsible for privacy?
• Privacy policy ownership assigned?
• DSAR response process owner?
• Incident response coordinator?
• Vendor review responsibility?

Making the Decision

Factor	Consider DPO	Consider Privacy Lead
Company Size	50+ employees	<50 employees
Data Volume	High volume personal data	Limited personal data
Sensitivity	Special category data	Standard data
Regulation	Heavily regulated industry	Lightly regulated
Customer Expectations	Enterprise clients	SMB/Consumer
Risk Tolerance	Low	Moderate

How Bastion Helps

Determining DPO requirements and establishing appropriate privacy leadership can involve nuanced analysis. Working with experienced partners helps ensure you have the right structure for your situation.

Challenge	How We Help
Needs Assessment	Expert evaluation of whether a DPO is required for your specific situation
Virtual CISO Services	Fractional privacy and security leadership for organizations that need expertise without a full-time hire
DPO Support	Guidance and backup for your designated DPO or privacy champion
Training	Programs to develop privacy expertise within your team
Ongoing Guidance	Access to expert advice on privacy matters as questions arise

Having experienced partners available helps ensure privacy responsibilities are handled appropriately, whether through a formal DPO arrangement or a lighter-touch approach suited to your risk profile.

---

Questions about DPO requirements or privacy leadership? Talk to our team →