The question usually arrives from outside. A customer's data processing agreement has a field for "Data Protection Officer". A supplier questionnaire asks whether you've appointed one. An investor's due diligence list asks who is responsible for data protection. None of these settle whether the law requires you to have one. Article 37 of the UK GDPR does.
The three tests
You must appoint a DPO if any one of these applies to you, as a controller or as a processor:
- You're a public authority or body. Courts and tribunals acting in their judicial capacity are excepted.
- Your core activities require regular and systematic monitoring of individuals on a large scale. Think tracking behaviour, location or health across a large user base as part of what you sell, not a marketing newsletter.
- Your core activities consist of processing special category data, or data about criminal convictions and offences, on a large scale. Health, biometric and genetic data all count as special category data.
"Core activities" means the processing is part of how you make money, not a support function such as payroll. "Large scale" isn't defined as a number. The Information Commission's guidance points to factors such as the number of people involved, the volume of data, how long it's kept and how far the processing reaches.
If none of the three applies, you don't have to appoint a DPO. The Data (Use and Access) Act 2025 left these tests unchanged.
If you appoint one anyway
Many companies appoint a DPO because customers ask for a name. That's allowed, but a voluntary DPO is still a DPO. Articles 38 and 39 then apply in full:
- the DPO is involved in data protection issues in good time;
- they're given the resources the role needs;
- they aren't told how to carry out their tasks, and can't be dismissed or penalised for doing them;
- they report to the most senior level of management;
- they can't hold another role that creates a conflict of interest, such as deciding why and how personal data is processed.
If you want someone to own privacy without taking on those duties, give the role a different title, such as privacy lead.
Can the role be outsourced?
Yes. Article 37(6) says the DPO can fulfil the tasks under a service contract. An outsourced DPO has the same position and tasks as an employee in the role. You publish their contact details and give them to the Information Commission, so customers and the regulator know who to contact.
For a small team, an outsourced DPO usually makes sense when:
- you process health, children's or biometric data as part of your product;
- enterprise customers keep asking for a named DPO in contracts and questionnaires;
- no one in-house has the time or independence to do the role properly.
One duty that applies whether or not you have a DPO
Since 19 June 2026, every controller has had to help people make data protection complaints, acknowledge each complaint within 30 days and deal with it without undue delay. There are no exemptions. If you're working out the DPO question, it's worth checking you have a complaints route in place too. Article 2 covers it.
Next step: if a customer has asked for a named DPO, or you think one of the three tests might apply, see Outsourced DPO or book a free diagnostic.
Sources: UK GDPR Articles 37 to 39 (legislation.gov.uk/eur/2016/679/article/37); Information Commission guidance on data protection officers; DPA 2018 s.164A as inserted by the Data (Use and Access) Act 2025 s.103.