You need a DPO if one of the following apply: * you are a public authority or body (except for courts acting in their judicial capacity) * your core activitie

You need a DPO if one of the following apply: * you are a public authority or body (except for courts acting in their judicial capacity) * your core activities require large scale, regular and systematic monitoring of individuals (for example, online behaviour tracking) * your core activities consist of large scale processing of special categories of data or data relating to criminal convictions and offences. That's from https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/ https://ico.org.uk/for-organisations/guide-to-the-general-da..., which is a pretty good summary generally, from the UK Information Commissioner's Office. If you're running an ad network building profiles of millions of users, then yes, you need a DPO. If you're storing extremely personal medical data, then yes, you need a DPO. If you're running an email newsletter, you 100% do not.