The 3 cases where appointing a DPO is mandatory (Article 37 GDPR explained simply)
·
Updated on ·
By 
Bertrand Bucelle · 8 min read
In brief
- Appointing a DPO is mandatory in three cases (Article 37 of the GDPR): 1) the organisation is a public authority or public body; 2) its core activities involve regular and systematic monitoring of individuals on a large scale; 3) its core activities involve large-scale processing of sensitive data or data relating to criminal convictions. Outside these cases, appointment is recommended but optional.
The 3 cases where appointing a DPO is mandatory
Appointing a Data Protection Officer (DPO) is not systematic. The GDPR has defined three specific cases where this function becomes a legal obligation. Understanding these cases is essential for any organisation processing personal data. For a complete overview of the subject, see our complete guide to the outsourced DPO.
Case no. 1: public bodies
Article 37 of the GDPR clearly stipulates that any public authority or public body must appoint a DPO, regardless of its size or the type of data processed.
- Local councils, departments, regions
- Public hospitals, university hospitals
- Public administrations (tax authorities, national education…)
- Public industrial and commercial establishments (EPIC)
CNIL has firmly reiterated this obligation through formal notices and an exemplary sanction against a local council for non-appointment.
Case no. 2: regular and systematic monitoring on a large scale
This criterion concerns organisations whose core activities consist of monitoring individuals 'on a large scale'. Regular: continuous or recurring according to a defined rhythm. Systematic: automatic, pre-established and organised.
- Advertising profiling (behavioural analysis for targeting)
- Geolocation (GPS tracking of service vehicles)
- Extended video surveillance monitored continuously
- Platforms tracking user behaviour
A mobile application that tracks the movements of tens of thousands of users easily reaches the notion of 'large scale'.
Case no. 3: large-scale processing of sensitive data
Appointment is mandatory when core activities involve large-scale processing of sensitive data (Article 9: health, political opinions, religious beliefs, trade union membership, genetic or biometric data, sexual life or orientation) or data relating to criminal convictions (Article 10).
- Healthcare establishments, clinics, laboratories
- Medical-social structures (nursing homes, medico-educational institutes)
- Companies analysing biometric data on a large scale
What if I'm not in any of these cases?
Appointment becomes optional, but CNIL strongly recommends it. A DPO, even outsourced and shared on a part-time basis, structures governance, reduces risk and demonstrates your good faith. Many principals now require an appointed DPO from their processors: it has become a criterion in tenders. An effective solution for small structures is the shared DPO.
What are the risks of non-appointment?
Failure to appoint, when it is mandatory, constitutes a breach of the GDPR subject to the sanctions of Article 83: up to €10 million or 2% of annual worldwide turnover. Beyond the fine, the absence of a DPO weakens the entire data governance and the relationship with authorities.
Take action
Download our self-assessment grid 'Am I required to appoint a DPO?' and assess your compliance in 5 minutes.
Discover the outsourced DPO →Test my compliance free of charge