In brief
- Article 37(1) of the GDPR makes it mandatory to appoint a data protection officer (DPO) in three cases.
- The obligation applies to the controller and to the processor alike.
- “Large scale” has no general threshold: the CNIL (French data protection authority) uses four assessment factors.
- Outside these cases, appointment remains possible and the CNIL encourages it.
- Failing to appoint a mandatory DPO exposes you to a fine of up to €10,000,000 or 2% of total worldwide annual turnover.
- Without a DPO, the record of processing activities, informing individuals and notifying personal data breaches still apply.
A mandatory DPO does not concern every business: Article 37(1) of the GDPR limits this obligation to three specific situations. The size of the organisation does not appear in this provision. What counts is the nature and scale of the processing.
The role may be performed by a member of staff or on the basis of a service contract (Article 37(6)). Using an outsourced DPO is therefore provided for by the Regulation itself.
Facts and sources verified on 5 October 2026.
When is a DPO mandatory? The three cases in Article 37(1) GDPR
Article 37(1) requires the controller and the processor to make the appointment “in any case”. Three situations trigger this obligation. A processor may therefore be required to appoint a DPO even if its client is not.
Public authorities and bodies
The first case covers any processing carried out by a public authority or body. Only courts acting in their judicial capacity are exempt from this rule. The CNIL gives as examples ministries, local authorities and public institutions. For these bodies, Article 37(3) allows a single DPO to be appointed for several of them, taking account of their organisational structure and size.
Regular and systematic monitoring on a large scale
The second case concerns organisations whose core activities require regular and systematic monitoring of data subjects on a large scale. The CNIL gives several examples. It cites insurance companies and banks for their customer files. It also cites telephone operators and internet service providers.
Sensitive or criminal data on a large scale
The third case covers core activities consisting of large-scale processing of special categories of data. These data are defined in Article 9 of the GDPR. The CNIL mentions biometric data, genetic data, health data, and data concerning sex life. It also cites racial or ethnic origin, political opinions, religious or philosophical beliefs and trade union membership. Data relating to criminal convictions and offences (Article 10) fall under the same regime.
Core activities and large scale: how to assess them
The last two cases rest on two concepts: “core activities” and “large scale”. The provision does not cover just any processing. It covers the processing that forms the organisation’s core activity. The CNIL’s examples show organisations whose very business relies on processing data. A bank manages its customer files; an operator manages its subscribers’ data.
For large scale, the CNIL cites Recital 91 of the GDPR. It refers to processing of a considerable amount of data at regional, national or supranational level. Such processing can affect a large number of data subjects and is likely to result in a high risk. The CNIL’s practical guide states that there is no general threshold. It uses four factors:
- the number of data subjects concerned, either as a specific number or as a proportion of the relevant population;
- the volume of data or the range of data processed;
- the duration or permanence of the processing;
- the geographical extent of the processing.
These criteria are assessed together. Every situation is different and deserves an analysis in light of your actual processing.
Typical situations: is a DPO mandatory or not?
The table below reproduces only the examples given by the CNIL and the text of the GDPR.
| Situation | DPO mandatory? | Legal basis |
|---|---|---|
| Ministry, local authority, public institution | Yes | Article 37(1)(a) GDPR; CNIL FAQ |
| Court acting in its judicial capacity | Not under this case | Exception provided for in Article 37(1)(a) |
| Bank or insurance company, for its customer files | Yes | Article 37(1)(b); CNIL FAQ |
| Telephone operator, internet service provider | Yes | Article 37(1)(b); CNIL FAQ |
| Hospital processing its patients’ data | Yes | Article 37(1)(c); large scale according to the CNIL guide |
| Urban public transport operator processing its users’ travel data | Large scale according to the CNIL; mandatory if this monitoring is part of its core activities | Article 37(1)(b); CNIL guide |
| Specialist processor geolocating a fast-food chain’s customers in real time | Large scale according to the CNIL; mandatory if this monitoring is part of its core activities | Article 37(1)(b); CNIL guide |
| Doctor in individual practice, with fewer than 10,000 patients a year | No, the processing is not on a large scale | Article 37(1)(c); CNIL guide |
| Lawyer in individual practice processing criminal data | No, the processing is not on a large scale | Article 37(1)(c); CNIL guide |
| Other organisations | No, unless a specific law applies; appointment encouraged | Article 37(4); CNIL FAQ |
Voluntary appointment encouraged by the CNIL
Outside the three cases in Article 37(1), Article 37(4) allows a DPO to be appointed voluntarily. The same article reserves cases where Union or Member State law requires the appointment. Associations and other bodies representing categories of controllers may also appoint a DPO. The CNIL states that, in other cases, appointment is “encouraged”.
Once appointed, a voluntary DPO performs the DPO tasks set out in Article 39 and enjoys the safeguards of Article 38.
A group of undertakings may appoint a single DPO, provided the DPO is easily accessible from each establishment (Article 37(2)). The choice between an employed, external or shared DPO is covered in our article internal, external or shared DPO.
What an organisation risks if it fails to appoint a mandatory DPO
Articles 37 to 39 of the GDPR fall within the scope of Article 83(4)(a). Infringing them exposes you to an administrative fine of up to €10,000,000. For an undertaking, the ceiling may reach 2% of total worldwide annual turnover for the preceding financial year. Whichever amount is higher applies.
The CNIL’s practical guide points out that failing to appoint a DPO, where appointment is mandatory, may lead to several measures. The CNIL may issue a call to order (rappel à l’ordre), an injunction or a fine. In its observatory of the DPO profession published on 1 July 2024, it announced that it would step up its scrutiny of the appointment phase. If you are subject to proceedings, a CNIL audit and sanctions lawyer can assist you.
What still applies even without a mandatory DPO
Not being required to appoint a DPO does not exempt you from any other GDPR obligation. Several articles mention the DPO “where applicable” or “where designated”. This wording shows that the main obligation exists independently of whether a DPO is in place.
- The record of processing activities (Article 30): it includes the name and contact details of the DPO, where there is one. Our practical guide to the GDPR record of processing activities explains how to keep it.
- Informing individuals (Articles 13 and 14): the information includes the DPO’s contact details, where applicable.
- Notifying personal data breaches to the CNIL (Article 33(3)(b)): the notification gives the contact details of the DPO or another contact point.
- The data protection impact assessment (Article 35): the controller seeks the advice of the DPO, where one has been designated. Without a DPO, a GDPR data protection impact assessment must still be carried out where it is required.
Our legal subscription (retainer) includes, among other things, the record of processing activities, the privacy notices and the personal data breach management procedure.
Entrusting the DPO role to a lawyer
The GDPR allows the tasks to be performed on the basis of a service contract. The CNIL’s guide cites a law firm among the legal entities that may perform this role. Hashtag Avocats offers an external DPO role entrusted to a lawyer. The firm is designated with the CNIL, with a named lead lawyer and a deputy.
The engagement includes four review meetings a year and availability on working days between them. It starts from €1,000 excl. VAT per month, on a scope agreed with you. The factors that affect this amount are set out in our article on the cost of an external DPO. Litigation and sanction proceedings fall outside the fixed fee, as a matter of professional ethics: oversight remains independent of defence. The engagement can also be added to the legal subscription, on the basis of a quote.
Frequently asked questions on when a DPO is mandatory
When do you need a DPO?
A DPO is mandatory for public authorities and bodies. It is also mandatory where core activities involve regular and systematic monitoring on a large scale. The third case covers large-scale processing of sensitive or criminal data.
Does an SME have to have a DPO?
Article 37(1) sets no threshold for headcount or turnover. A small organisation may therefore be concerned if its core activities fall within one of the three cases. Conversely, a large business may not be.
Does a processor have to appoint a DPO?
Yes, where it meets one of the cases in Article 37(1) itself. The provision expressly covers both the controller and the processor. The CNIL gives the example of a specialist processor that geolocates a fast-food chain’s customers in real time.
Does a doctor in private practice have to appoint a DPO?
The CNIL’s guide refers to a doctor in individual practice with fewer than 10,000 patients a year. According to the CNIL, such a doctor does not process data on a large scale. Appointment is therefore not mandatory on that basis. It remains possible and encouraged.
What does a business risk if it has not appointed a mandatory DPO?
The CNIL may issue a call to order, an injunction or a fine. The fine may reach €10,000,000 or 2% of total worldwide annual turnover, whichever is higher.
How do you notify the CNIL of a DPO appointment?
The appointment is made exclusively online, through the CNIL’s dedicated online service. No letter or supporting document is required. The procedure is explained in our article on designating a DPO with the CNIL.
Official sources
- Regulation (EU) 2016/679 of 27 April 2016 (GDPR), Articles 13, 14, 30, 33, 35, 37, 38, 39 and Recital 91 – EUR-Lex
- GDPR, Chapter IV (Articles 37 to 39 on the data protection officer) – CNIL (in French)
- GDPR, Chapter VIII, Article 83(4)(a) (administrative fines) – CNIL (in French)
- “Règlement européen : le délégué à la protection des données, c’est obligatoire ?” (European regulation: is a data protection officer mandatory?, our translation) – CNIL (in French)
- “Guide pratique RGPD – Délégués à la protection des données” (GDPR practical guide – Data protection officers, our translation), November 2021 edition – CNIL (in French)
- “Observatoire du métier de DPO” (DPO profession observatory, our translation), 1 July 2024 – CNIL (in French)
This article sets out the current state of the law for general information purposes, as verified on 5 October 2026. It does not constitute legal advice. Every situation is different and deserves a dedicated analysis.
