You most likely don't need a DPO: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/do-rule

You most likely don't need a DPO: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/application-regulation/do-rules-apply-smes_en https://ec.europa.eu/info/law/law-topic/data-protection/refo... Check out the rest of the website, it is pretty helpful. Don't worry too much, GDPR is both common sense and designed do go after the big companies. Some rules are intentionally vague in order to be hard to circumvent using armies of lawyers and/or technical 'innovations' in exploiting personal data.