Free DPO checker
Do I need a Data Protection Officer?
Four quick questions and you get a plain answer. It's free, and you don't need to sign up.
This is general information, not legal advice. It covers the GDPR triggers and the German rule, and it is for companies and public bodies alike.
Your result
Why
What happens next
The guide has more examples of what counts as a core activity and what enterprise customers tend to expect. Read the full guide: do I need a DPO?
Selling to the EU or UK from outside? Check which representatives you need.
How it works
The GDPR says when a DPO is mandatory in Article 37(1). We ask one question for each of its three triggers, plus one for the German rule that the guide also covers.
Where a trigger turns on "core activities" or "large scale", the regulation does not give a number, so a Not sure answer leads to a suggestion to talk to us rather than a guess.
The controller and the processor shall designate a data protection officer in any case where:
(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.
Article 37(1), GDPR as published on EUR-Lex. Everyone else may appoint one too: "In cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies representing categories of controllers or processors may or, where required by Union or Member State law shall, designate a data protection officer." (Article 37(4)). Read Article 37 in full.
FAQ
Frequently asked questions
When does a company have to appoint a DPO?
GDPR Article 37 lists three cases: you are a public authority or body (courts acting in their judicial capacity are excepted), your core activities involve regular and systematic monitoring of people on a large scale, or your core activities involve large-scale processing of sensitive data or data about criminal convictions and offences. Germany adds its own rule on top (BDSG Section 38), and the checker asks about that as well.
Can a company without a legal duty still appoint a DPO?
Yes. Article 37(4) lets any organization designate one voluntarily. Companies without a legal duty often do it because customers and investors ask who their DPO is, or because privacy work has outgrown ad hoc handling.
Can the DPO be an outside firm?
Yes. The DPO can be a staff member or an outside firm on a service contract, chosen for professional qualities and expert knowledge of data protection law (Article 37(5) and (6)). You publish the DPO's contact details and tell the supervisory authority (Article 37(7)).
What if my answers are not clear?
"Core activities" and "large scale" have no number in the regulation, so a Not sure answer leads to a suggestion to talk to us rather than a guess. A short call is usually quicker than a legal opinion.
How long does the check take?
It's four short questions, one for each legal trigger plus one for the German rule. You see your answer as soon as you finish, and you don't need to sign up or give an email address.