In short. A website operator needs a DPO when Article 37 covers its public-body status or large-scale core activities, or additional applicable law requires appointment.
Definition: A data protection officer (DPO) advises on and monitors an organisation's compliance with data protection law. A website operator subject to the General Data Protection Regulation (GDPR) must appoint a DPO when Article 37's public-body or large-scale core-activity criteria apply, or when additional applicable law requires appointment.
Key facts
- Article 37(6) of the GDPR permits a DPO to be an employee or to work under a service contract.
- The European Data Protection Board's (EDPB) small-business guide defines core activities as operations essential to the organisation's objectives, including activities inseparable from its business.
- The Article 29 Working Party's DPO guidelines assess a website business and its analytics provider separately: either organisation, or both, can meet the appointment criteria.
Which Article 37 criteria require appointment?
As of 17 October 2026, Article 37(1) of the GDPR text on EUR-Lex requires a DPO in the following cases:
- A public authority or body carries out the processing, except courts acting in their judicial capacity.
- The organisation's core activities require regular and systematic monitoring of individuals on a large scale.
- Its core activities involve large-scale processing of special-category personal data under Article 9, such as health data, or personal data concerning criminal convictions and offences under Article 10.
The DPO guidelines explain that the special-category and criminal-data criteria apply as alternatives.
Article 37 applies to controllers and processors. Under Article 4(7), a controller determines the purposes and means of processing personal data; under Article 4(8), a processor processes it on the controller's behalf. Article 37(4) also allows Union or Member State law to require appointment in additional situations.
What counts as monitoring on a large scale?
The EDPB's small-business guide includes internet tracking and profiling within regular and systematic monitoring, including behavioural advertising. Profiling means automated processing that evaluates personal aspects, such as interests or behaviour, under Article 4(4) of the GDPR.
The EDPB assesses scale using the number or proportion of people concerned, the volume of data, the duration of processing and its geographical scope. Its examples include a hospital's routine patient-data processing as large scale and a single general practitioner's patient-data processing as smaller scale.
The DPO guidelines give no universal numerical threshold. They describe regular monitoring as ongoing or recurring, and systematic monitoring as organised or conducted according to a plan. Payroll and standard IT support are generally ancillary activities.
Does using website analytics require a DPO?
The DPO guidelines describe a small family business selling household appliances in one town. It uses a provider of website analytics and targeted advertising services. The business's limited customer activity falls below large scale, while the provider's combined processing across many customers requires a DPO under Article 37(1)(b).
The same guidelines recommend documenting the appointment assessment unless the absence of a requirement is obvious, and updating it when new activities or services change the assessment.
What follows when appointment is required?
Article 37(5) of the GDPR requires professional qualities, expert knowledge of data protection law and practices, and ability to perform the role. Article 37(7) requires publication of the DPO's contact details and communication of those details to the supervisory authority.
Article 38 requires resources and access to processing operations, direct reporting to the highest management level, and freedom from instructions concerning DPO tasks. Other duties must avoid conflicts of interest.
Related terms
- GDPR lawful basis for web data
- Data protection impact assessment
- Does the GDPR records exemption cover every small business?
- When does a non-EU website need an EU GDPR representative?
FAQ
Can I appoint a DPO voluntarily?
Yes. The DPO guidelines explain that voluntary appointment brings the designation, position and task requirements of Articles 37 to 39 into effect.
Can a group of companies share a DPO?
Yes. Article 37(2) of the GDPR permits a single DPO for a group of undertakings if the DPO is easily accessible from each establishment.
Can I appoint someone who decides how customer data is used?
The EDPB guide identifies a conflict where another role determines the purposes and means of personal-data processing. It lists management functions, including head of IT, as potentially conflicting roles.
Sources
- European Union, "Regulation (EU) 2016/679", 27 April 2016
- European Data Protection Board, "Data Protection Officer", undated
- Article 29 Data Protection Working Party, "Guidelines on Data Protection Officers ('DPOs')", revised 5 April 2017
Check how a page reads to answer engines. Open the GEO score analyzer