I'm honestly not sure about the specifics on who legally has to have a DPO, just that it's a thing and a lot of people do. There's also the weird requirement th

I'm honestly not sure about the specifics on who legally has to have a DPO, just that it's a thing and a lot of people do. There's also the weird requirement that there be some EU-resident "responsible person" if your organization is not based in the EU that I'm fuzzy on the details of. Even if you can avoid both of those you still need a point person who answers GDPR-related requests. Whether you end up calling that person the DPO (with the legal responsibilities and consequences that comes with) or just the "GDPR Guy" (also known as Ted from Accounting...) it's still something new you have to deal with, train for, etc.