Does Your Business Need a DPO? Probably Not
4 February 2026 · Mary Molloy Solicitors
The Data Protection Officer question produces needless anxiety and occasional needless salaries. The mandatory triggers are three and narrow; most SMEs meet none of them; and appointing one voluntarily carries obligations people rarely read first.
The three triggers
A DPO is mandatory where: the controller is a public authority or body; core activities involve regular and systematic monitoring of data subjects on a large scale; or core activities involve large-scale processing of special category or criminal offence data. 'Core' and 'large-scale' carry the weight — a shop with CCTV is not systematically monitoring at scale, and a physiotherapist holding client health files is not processing special category data at the scale the trigger contemplates. Medical facilities, insurers profiling at volume, and tracking-based businesses are the territory the rules aim at.
The voluntary appointment trap
Appoint a DPO you did not need and the statutory regime attaches anyway: independence, no dismissal for performing the role, no conflicting duties, reporting to top management, published contact details. The office manager cannot be a compliant DPO while also deciding what data the business processes — the conflict rule sees to that. Titles are load-bearing here; grant this one only deliberately.
The right-sized answer
What every business needs is ownership without the statute: a designated data protection lead who maintains the data map, fields requests, runs the breach drill and knows when to take advice. Call them the data protection contact, give them the job description, skip the protected title. If growth later carries you toward a trigger — scale monitoring, health data volume — take advice at that threshold; the appointment done properly is a structure, not a business card.
Read more in our main guide: GDPR for Small Business: Compliance Without the Panic · or back to the blog.
This page contains general information about Irish law and practice. It is not legal advice, it may not reflect your circumstances, and reading it does not create a solicitor–client relationship with Mary Molloy Solicitors. We do not advise on taxation; please speak to your accountant or Revenue. In contentious business, a solicitor may not calculate fees or other charges as a percentage or proportion of any award or settlement.