Mandatory DPO: when do you actually need to appoint one?
A DPO is mandatory for all public bodies and for private companies whose activities involve regular and systematic monitoring on a large scale, or the large-scale processing of sensitive or criminal data. Company size is not a criterion. In other cases, appointment remains highly recommended.
The General Data Protection Regulation (GDPR) has turned eight. Yet, one question continues to haunt legal departments, CISOs, and executives: is appointing a DPO mandatory for our organization?
Some organizations decide to appoint one voluntarily to reassure their key accounts. Others move forward blindly, exposing themselves to heavy sanctions from the CNIL (French Data Protection Authority). Here is the exact framework to determine whether a DPO is mandatory for your company.
What is a DPO and what does the GDPR say about the requirement?
The DPO (Data Protection Officer) is the person appointed by an organization to oversee compliance with its personal data processing activities. Article 37 of the GDPR precisely defines the cases where their appointment is a legal obligation.
The European regulation distinguishes between two situations:
- The public sector : appointing a DPO is automatic and systematic
- The private sector : the obligation depends on the nature of the activities, not the size of the organization
For private companies, associations, or independent professionals, the 250-employee threshold does not apply. Only the sensitivity and scale of the data processing activities matter.
To manage this assessment with peace of mind, many legal departments and DPOs structure their approach using specialized GDPR compliance software that centralizes documentation and provides an objective risk analysis.
In which cases is the appointment of a DPO mandatory?
Appointing a DPO is mandatory in three cases defined by the GDPR and clarified by the European Data Protection Board (EDPB): being a public authority or body, monitoring individuals on a regular and systematic basis on a large scale, or processing sensitive or criminal data on a large scale.
Public authorities and bodies
For the public sector, the question does not arise: the appointment of a DPO is mandatory, regardless of size or data volume. The only exception is for courts acting in their judicial capacity.
This includes, in particular:
- town halls
- intercommunal authorities
- university hospitals
- central government departments
Regular and systematic monitoring on a large scale
You are affected if your core business involves monitoring individuals on a recurring, organized, and large-scale basis.
Concrete examples:
- telecom operators
- banks, for credit scoring
- private security companies, for video surveillance of shopping centers
- fitness apps that collect geolocation data
- marketing agencies engaged in mass behavioral advertising targeting on the web
Large-scale processing of sensitive or criminal data
This criterion applies to organizations that process large volumes of "special category" data (Article 9 of the GDPR) or data relating to criminal convictions and offenses (Article 10 of the GDPR).
Special category data includes, in particular:
- health data
- political opinions
- sexual orientation
- racial or ethnic origin
- biometric data
Concrete examples: a private clinic, a developer of shared medical record software, an insurance company, or an HR start-up managing criminal record checks for freelance platforms.
What is meant by "large scale"?
The GDPR does not set a specific numerical threshold to define "large scale." The CNIL and the EDPB use four sets of criteria:
- the number of data subjects, either as an absolute number or as a percentage of the population
- the volume of data processed
- the duration or permanence of the processing activity
- the geographical extent of the processing activity
Summary: Is a DPO mandatory for your situation?
Who must appoint a DPO and what profile should you choose?
Appointing a DPO is the responsibility of the company's legal representative, i.e., the CEO or President. Once the obligation is confirmed, they must choose between an internal or external DPO, while avoiding any conflicts of interest.
Internal vs. external DPO: what are the differences?
The major pitfall: conflict of interest
Article 38(6) of the GDPR allows the DPO to perform other tasks, provided one strict condition is met: the absence of a conflict of interest. The DPO cannot hold a position where they determine the purposes and means of the processing operations they are supposed to oversee.
Prohibited roles :
- Chief Information Officer (CIO)
- Chief Marketing Officer
- Chief Human Resources Officer (CHRO)
- Chief Executive Officer
The CNIL and European authorities impose heavy sanctions on companies that assign the DPO role to these operational decision-makers.
How do you register a DPO with the CNIL?
Registering a DPO with the CNIL involves three steps: formalizing the appointment through a legal document, completing the online designation form on the CNIL website, and publishing their contact details in an accessible manner. This administrative process is a mandatory requirement whenever a DPO must be appointed.
- Formalize the internal appointment : draft a mission letter (for an internal DPO) or a service agreement (for an external DPO). This document should specify their duties, their direct reporting line to senior management, and the guarantee of their resources.
- Complete the online registration : go to the dedicated procedures section on the official CNIL website. The form requires the organization's contact details, the identity of the DPO (or the legal entity acting as DPO), and their professional contact information.
- Publish the DPO's contact details : the GDPR requires at least a dedicated email address (e.g., dpo@yourcompany.com), which should be accessible, particularly in your online privacy policy, so that customers, users, and employees can contact them easily.
What is the DPO's role regarding the AI Act?
With the entry into force of the European Artificial Intelligence Act (AI Act), the DPO's scope of action is naturally expanding. The governance infrastructure they have established serves as an essential foundation for companies that deploy or design AI systems.
This existing GDPR governance makes it possible to anticipate synergies between the two regulations and to manage your AI Act project effectively.
Which regulatory developments should you monitor?
Two topics require careful monitoring and should be validated by your legal department before any strategic decisions are made.
The evolution of the "large-scale" concept : follow the EDPB WP243 guidelines. National authorities assess this concept on a case-by-case basis. Processing health data by a single doctor is not considered large-scale, whereas doing so for a network of clinics is.
Strict case law on conflicts of interest : European decisions, particularly those from the Luxembourg and Belgian data protection authorities, confirm that a DPO who retains control over the IT or marketing budget exposes the company to immediate sanctions for failing to respect the independence of their role.
In summary: should you appoint a DPO?
A DPO is mandatory for any public body and any private company that monitors individuals on a regular and systematic basis on a large scale, or that processes sensitive or criminal conviction data on a large scale. The size of the organization is not a factor.
Once the obligation is confirmed, choose a profile with no conflicts of interest, formalize their appointment, and notify the CNIL. Even when a DPO is not mandatory, appointing one builds customer trust and prepares your organization for the requirements of the AI Act.
FAQ - Mandatory DPO
What are the risks if I do not appoint a DPO when I am required to do so?
Failure to appoint a DPO constitutes a direct violation of the GDPR. The CNIL can impose administrative financial penalties of up to 10 million euros or 2% of total worldwide annual turnover, whichever is higher. In addition, there is a significant reputational risk with your B2B clients and partners.
Is a processor required to appoint a DPO?
Yes, if its activities meet the criteria of Article 37 of the GDPR. The regulation applies to both controllers and processors (SaaS providers, hosting companies, managed service providers). A processor that handles sensitive data or performs systematic large-scale monitoring on behalf of its clients must appoint its own DPO.
Does a company with fewer than 250 employees need to appoint a DPO?
It depends on your activities, not your size. The 250-employee threshold is not a factor in the obligation to appoint a DPO. A small organization that processes health data on a large scale or monitors individuals systematically must appoint one. For an SME with standard business activities, appointment is still highly recommended.
Can a CIO or HR Director be a DPO?
No, due to the conflict of interest prohibited by Article 38.6 of the GDPR. The DPO cannot personally determine the purposes and means of the processing operations they oversee. Positions such as CIO, Marketing Director, HR Director, or CEO are therefore incompatible with the DPO role, and authorities impose heavy penalties for such dual roles.
Where should I publish my DPO's contact details?
The DPO's contact details must be published in an accessible manner, particularly in your online privacy policy. The GDPR requires at least a dedicated email address, for example dpo@yourcompany.com, so that clients, users, and employees can easily contact the Data Protection Officer.
Does a solo practitioner doctor process health data on a large scale?
No, the processing of health data by a solo practitioner is not considered large-scale processing, unlike that of a network of clinics. National authorities assess this concept on a case-by-case basis, based on the WP243 guidelines from the European Data Protection Board (EDPB).
