{"id":3918,"date":"2026-06-30T08:50:00","date_gmt":"2026-06-30T06:50:00","guid":{"rendered":"https:\/\/www.lablogic.pl\/how-to-determine-if-an-organization-must-appoint-a-dpo\/"},"modified":"2026-09-27T19:58:33","modified_gmt":"2026-09-27T17:58:33","slug":"how-to-determine-if-an-organization-must-appoint-a-dpo","status":"publish","type":"post","link":"https:\/\/www.lablogic.pl\/en\/how-to-determine-if-an-organization-must-appoint-a-dpo\/","title":{"rendered":"How to determine if an organization must appoint a DPO?"},"content":{"rendered":"\n

Micha\u0142 Rutkowski<\/strong><\/a> \u2022 for management and executives \u2022 published June 30, 2026 \u2022 updated September 27, 2026 \u2022 9 min read<\/p>\n\n\n\n

\n
\n
\n\n\n\n<\/div>\n<\/div>\n\n\n\n
\n
\n

Brief answer<\/h2>\n\n\n\n

The obligation to appoint a Data Protection Officer arises in three cases specified in Article 37(1) of the GDPR. These are when processing is carried out by a public authority or body, when the core activity consists of processing operations which, by virtue of their nature, scope or purposes, require regular and systematic monitoring of data subjects on a large scale, or when the core activity consists of processing on a large scale of special categories of data referred to in Article 9 of the GDPR, or of personal data relating to criminal convictions and offenses referred to in Article 10 of the GDPR. Outside these cases, the appointment of a DPO is voluntary, unless the obligation arises from another provision of Union or national law. None of the conditions refer to the size of the organization or the number of employees \u2014 the nature of the activity and the scale of processing are decisive, which is why the answer requires analysis, not checking a single threshold. <\/p>\n<\/div>\n\n\n\n

Why this question arises at all<\/h2>\n\n\n\n

The conditions in Article 37(1) of the GDPR are intentionally imprecise. The Regulation does not define ‘core activity,’ ‘large scale,’ or ‘regular and systematic monitoring’ \u2014 these concepts were only clarified by the Article 29 Working Party guidelines, subsequently approved by the European Data Protection Board. The Personal Data Protection Office, when responding to questions about specific industries, consistently refuses to provide a universal threshold and indicates that the assessment is carried out by the controller itself. <\/p>\n\n\n\n

For organizations, this means an unusual situation. The provision imposes an obligation but does not provide a test that can be mechanically passed. The result depends on what the organization does and on what scale, not on how large it is. <\/p>\n\n\n\n

The question usually reappears at three moments. These are when launching a new data-driven service, when changing the organizational structure, or when an external party \u2014 a client, insurer, auditor \u2014 asks for the inspector’s contact details and it turns out that no one can indicate on what basis the organization does not have one.<\/p>\n\n\n\n

What needs to be determined before making a decision<\/h2>\n\n\n\n

The analysis has three steps corresponding to the three conditions, plus two control questions. Go through them in order \u2014 the first condition is decisive and does not require a scale assessment. <\/p>\n\n\n\n

1. Is the organization a public authority or body?<\/h3>\n\n\n\n

The first condition applies regardless of the scale of processing. If processing is carried out by a public authority or body, a DPO is mandatory. The GDPR excludes only courts in the exercise of their judicial functions. <\/p>\n\n\n\n

Polish law clarifies this scope. According to Article 9 of the Act of May 10, 2018, on personal data protection, public entities obliged to appoint an inspector include public finance sector units, research institutes, and the National Bank of Poland. This list resolves doubts that remain open in other member states and closes the matter for most public organizations \u2014 further scale analysis is not needed for them. <\/p>\n\n\n\n

\n

It is worth noting an intermediate situation. A municipal company or an institution performing public tasks under a contract does not always fall into this category, yet may be subject to the obligation on other grounds. In such a scenario, one proceeds to the next steps instead of stopping at the answer ‘we are not a public finance sector unit.’ <\/p>\n<\/div>\n\n\n\n

2. Does the core activity require monitoring individuals on a large scale?<\/h3>\n\n\n\n

The second condition does not require monitoring itself to be the core activity \u2014 it is enough that the core activity requires it by virtue of its nature, scope or purposes. Three elements must be assessed, and all of them must be present together.<\/p>\n\n\n\n

Core activity<\/strong> is \u2014 according to the guidelines \u2014 key operations necessary to achieve the organization’s objectives, not ancillary activities. Processing employee data for HR and payroll purposes is an ancillary activity in almost every organization, even a large one. It is different where data processing is inextricably linked to the service. A security company monitoring facilities or a hospital maintaining medical records cannot provide its service without processing data, so it is an element of the core activity. <\/p>\n\n\n\n

Regular and systematic monitoring<\/strong> means repetitive and organized action \u2014 carried out at defined intervals, continuous or periodic, according to an adopted data collection plan. The guidelines here include, among others, tracking online behavior, profiling, behavioral advertising, and loyalty programs. <\/p>\n\n\n\n

Large scale<\/strong> has no numerical threshold. The guidelines recommend weighing four factors. These are the number of data subjects, the scope and variety of data processed, the duration of processing, and the geographical reach. Examples of large-scale processing include hospitals, telecommunications operators, geolocation systems, insurers, and internet search engines. <\/p>\n\n\n\n

The outcome of this step can be ambiguous, and that is normal. It is important that the four factors are actually assessed, and the assessment documented. <\/p>\n\n\n\n

3. Does the core activity consist of processing special categories of data on a large scale?<\/h3>\n\n\n\n

The third condition covers special categories of data referred to in Article 9 of the GDPR \u2014 including health data, biometric data, and data concerning trade union membership \u2014 and personal data relating to criminal convictions and offenses referred to in Article 10 of the GDPR, processed on a large scale as part of the core activity.<\/p>\n\n\n\n

This is where the question of healthcare most often arises. When answering a question about a non-public medical entity serving approximately two thousand patients, the Personal Data Protection Office did not provide a definitive ruling but pointed to reference points from the guidelines. A hospital is an example of large-scale processing, while processing by a single doctor practicing individually is not. Between these two extremes, an organization must assess its own situation, considering the nature of its activity and the scale of documentation, and revisit this assessment when the scale changes. <\/p>\n\n\n\n

4. Does the obligation not arise from another provision?<\/h3>\n\n\n\n

Article 37(4) of the GDPR allows for the obligation to appoint an inspector to arise from Union law or national law also in cases not covered by paragraph 1. Before concluding your analysis with a negative result, check the sectoral regulations applicable to your industry. <\/p>\n\n\n\n

Distinguish between a DPO and roles introduced by other regimes. The Act on the National Cybersecurity System requires essential and important entities to appoint at least two persons responsible for maintaining contacts with entities of the national cybersecurity system; one person is sufficient only for a micro or small enterprise and for an important entity that is a public entity. This is a separate obligation, with a different basis and scope \u2014 its fulfillment does not replace the appointment of a data protection officer, and the appointment of an inspector does not exempt from that obligation. <\/p>\n\n\n\n

5. Has the analysis been carried out separately for the role of controller and processor?<\/h3>\n\n\n\n

Article 37(1) of the GDPR addresses the obligation to both the controller and the processor. An organization that provides services to others \u2014 hosting, HR support, archiving, system maintenance \u2014 also assesses the conditions for processing carried out on behalf of others. It sometimes happens that the result is different for both roles. An entity may not have an obligation as a controller of its own data, but it does as a processor handling data on a large scale for clients. The number of inspectors is a separate organizational decision. A group of undertakings may appoint a single data protection officer provided that they are easily accessible from each establishment (Article 37(2)), and several public authorities or bodies may appoint a joint officer, taking account of their organizational structure and size (Article 37(3)). <\/p>\n\n\n\n

Three possible outcomes of the analysis<\/h3>\n\n\n\n
Outcome<\/th>What it implies<\/th>What must be established<\/th><\/tr><\/thead>
At least one condition met<\/td>DPO appointment is mandatory<\/td>Appointment document, notification to the President of the Personal Data Protection Office, publication of data, ensuring conditions for performing the function<\/td><\/tr>
Conditions not met, organization voluntarily appoints a DPO<\/td>The WP 243 guidelines state that the same requirements apply to a voluntarily appointed inspector as to a mandatory one<\/td>Same as above \u2014 voluntariness applies to the decision, not the regime<\/td><\/tr>
Conditions not met, organization does not appoint a DPO<\/td>No obligation, but the accountability obligation remains<\/td>Documented analysis with date, input data, and approving person<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

The third variant is the one most often forgotten. The guidelines explicitly recommend that the controller and processor document the internal analysis carried out \u2014 unless the lack of obligation is obvious \u2014 precisely to be able to demonstrate that the appropriate factors have been taken into account. <\/p>\n\n\n\n

\n

What should management know?<\/h2>\n\n\n\n

The decision to appoint an inspector is not a technical decision of the IT or HR department. The choice of the role, its placement in the structure, and ensuring independence are management decisions, and responsibility for them remains with the controller \u2014 i.e., the organization represented by its management. <\/p>\n\n\n\n

Three things management should understand before making a decision.<\/p>\n\n\n\n

\n\n

Remember<\/p>\n\n\n\n

The determination that there is no obligation must be demonstrable \u2014 an analysis without a document is practically non-existent.<\/p>\n\n<\/div>\n\n\n\n

Secondly, appointing a DPO does not transfer responsibility for compliance to them; the inspector monitors, advises, and acts as a contact point, while decisions remain with the controller. Thirdly, the function requires conditions. These are access to information, resources, absence of conflicts of interest, and direct reporting to top management \u2014 an inspector appointed without these conditions creates the appearance of compliance, not actual compliance. The Act also allows a person to be designated to stand in for the inspector during their absence, taking account of the criteria in Article 37(5) and (6) of the GDPR; the provisions on the inspector apply accordingly to the deputy, and their designation is subject to notification and publication on the same terms (Article 11a of the Act of May 10, 2018). <\/p>\n<\/div>\n\n\n\n

Most common errors<\/h2>\n\n\n\n

Supervisory practice shows that more problems arise after the decision than during its making.<\/p>\n\n\n\n