That's not what the GDPR says. There's no bright line for the number of employees handling data. A DPO should be assigned if: >(a) the processing is carried o

That's not what the GDPR says. There's no bright line for the number of employees handling data. A DPO should be assigned if: >(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity; >(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or >(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10. (Article 37) And in any case a data protection officer is different from a representative, as the title of Article 27 indicates ("Representatives of controllers or processors not established in the Union").