Do I Need a Data Protection Officer (DPO)?

The short answer

Most small businesses do not need to appoint a formal Data Protection Officer. The role is only legally required in specific circumstances, and running a shop, agency, practice or trades business rarely triggers them. But there is an important catch: even when a DPO is not mandatory, someone in your business still needs to own data protection. Getting this distinction right saves you from both over-engineering and quiet non-compliance.

When a DPO is legally required

Under Article 37 of the UK GDPR, you must appoint a Data Protection Officer in only three situations:

• You are a public authority or public body (courts acting in their judicial capacity are the exception). This covers organisations like councils, schools, NHS bodies and government departments.
• Your core activities involve regular and systematic monitoring of individuals on a large scale. Think of an organisation whose main business is tracking behaviour — large-scale profiling, ad-tech, location tracking or behavioural advertising networks.
• Your core activities involve large-scale processing of special category data, or data about criminal convictions and offences. Special category data includes health, race, religion, sexual orientation, biometric and genetic data.

If none of these apply, the law does not require you to appoint a DPO.

What “core activities” and “large scale” really mean

Two phrases do a lot of work here, so it’s worth being precise.

Core activities are the primary things you do to deliver your service — not routine back-office admin. Every business processes staff payroll and holds some customer contact details, but that is ancillary, not core. A private hospital’s core activity is delivering healthcare (which needs health data); a security firm’s core activity may be systematic CCTV monitoring. A café’s core activity is selling coffee.

Large scale has no fixed number in the legislation. Regulators look at things like the number of people affected, the volume and range of data, how long the processing lasts, and its geographical reach. A single GP surgery is generally treated as not large scale; a hospital or a national health app is. When you’re genuinely unsure, the safe move is to document your reasoning.

Most small businesses need a responsible person, not a DPO

Here’s the part that trips people up. Not being legally required to appoint a DPO is not the same as having no one responsible for data protection.

The UK GDPR still expects you to comply with all its principles — lawfulness, transparency, security, accountability and the rest. In practice that means naming a person (often the owner, a director or an office manager) who:

• knows what personal data you hold and why
• keeps your privacy notice, records and policies up to date
• handles data subject requests and any personal data breaches
• is the point of contact for staff questions and, if needed, the ICO

This person is not a statutory DPO. They can be fully involved in business decisions, they have no special legal protections, and you can call the role whatever you like — just don’t call them your “Data Protection Officer”, because that specific title carries legal duties (more on that below).

What a statutory DPO actually involves

If you do fall within Article 37, the role is more than a job title. A formal DPO comes with obligations under Articles 38 and 39:

• Independence. They must be free to act without instruction on how to carry out their tasks and cannot be dismissed or penalised for doing the job properly.
• No conflict of interest. They can’t also be the person who decides the purposes and means of processing — so your IT director, head of marketing or managing director usually can’t double up as DPO.
• A direct line to the top. They report to the highest level of management.
• Expert knowledge of data protection law and practice, proportionate to your processing.
• Published contact details. You must publish the DPO’s contact details and provide them to the ICO.

A DPO does not have to be an employee. Many organisations that need one appoint an external, outsourced DPO on a contract — which can be more practical and cost-effective than hiring in-house.

Appointing a DPO voluntarily — a word of caution

You can choose to appoint a DPO even when you’re not required to. But be aware: if you formally designate someone as your DPO, the ICO expects the same legal requirements to apply — independence, no conflict of interest, the statutory tasks and protections. So don’t hand the title to your busy office manager as a nice-sounding label. If you only want someone accountable for data protection, give them a different job title (for example, “data protection lead”) and keep the flexibility.

A quick decision checklist

Work through these:

1. Are you a public authority or public body? If yes — you need a DPO.
2. Is large-scale, regular, systematic monitoring of people one of the main things your business does? If yes — you likely need a DPO.
3. Is large-scale handling of health, biometric, criminal-offence or other special category data one of your core activities? If yes — you likely need a DPO.
4. If you answered no to all three, you probably don’t need a formal DPO — but you do need a named, competent person responsible for data protection.

If any answer is “maybe”, write down your reasoning and the data you process. That record is itself part of good accountability.

Getting it right

The goal isn’t to appoint the grandest-sounding role you can; it’s to make sure someone competent genuinely owns data protection and that you can show your reasoning. For most small businesses in Leeds and across Yorkshire, that means a clear internal owner, sensible policies and good security — not a statutory DPO.

If you’d like a hand working out where your business sits, or getting your data protection housekeeping in order, talk to our team. We help small businesses keep compliance proportionate and practical — see how we approach managed IT and cyber security, and if you’re still finding your feet with the rules, start with our GDPR basics for UK small business guide.