It's not a question of size, it's only needed if processing your customers' private data is your core activity, ie. if you operate an ad network that builds per

It's not a question of size, it's only needed if processing your customers' private data is your core activity, ie. if you operate an ad network that builds personal profiles of people.