Who Must Appoint a DPO

Since Amendment 13 to the Privacy Protection Law came into force in August 2025, many organizations have asked the same question: are we required to appoint a data protection officer, or DPO? The answer is neither "everyone" nor "no one". The answer depends on the type of organization, the kind of information it holds and the nature of its activity. This article explains the principles and how to check your own position.

The article is general and does not replace a review of the organization's needs. The wording of the law and the guidance of the Privacy Protection Authority are the binding sources.

What a data protection officer is

The DPO is an officer within the organization (or an external service provider) responsible for making sure the organization meets the requirements of privacy law: the way personal information is collected, what it is used for, who accesses it and how it is kept. For background and the officer's tasks, see our page on the Data Protection Officer.

Who must appoint a DPO

The law defines the bodies to which the duty to appoint applies. In summary, and without replacing the current text of the law, these include:

• Public bodies. Obliged to appoint an officer.
• Bodies whose main activity is trading in or transferring information. For example, someone who holds and manages a database in order to pass it to others for payment.
• Bodies whose core activity involves systematic, large-scale monitoring of information about people. Such as continuous tracking of patterns of behavior, location or habits of customers or users.
• Bodies whose core activity involves processing particularly sensitive information on a significant scale. Medical, genetic, biometric or financial information are familiar examples.

The key phrases are "core activity" and "significant scale". A small business that keeps customers' contact details is not necessarily in this group, whereas a clinic, an app company collecting location data, or a company managing the medical information of thousands of people may be obliged to appoint a DPO.

How to check whether the duty applies to you

Questions worth going through:

1. What kind of information do you hold? Contact details only, or also medical, financial or biometric information, or information detailing opinions and beliefs.
2. How many people are in your databases? A large volume of personal details changes the picture.
3. Is the information the core of the business or a by-product? Core activity is the activity without which the business would not operate as it does.
4. Do you monitor people systematically? Cameras, tracking systems, behavior analysis on a website or app.
5. Do you pass on or share information with others, or receive it from others? Cloud providers, marketing companies, business partners.
6. Are you a public body, or do you act on behalf of one?

If several answers are yes, do not wait: look into the matter properly.

Examples for illustration

The following examples are for illustration only, and in each case the answer depends on the circumstances:

• A clinic or medical institute holding patients' medical files. Medical information is defined as sensitive and is part of the core activity, so it is worth checking carefully whether the duty applies.
• An app collecting users' location and behavior data. Systematic monitoring of this kind is a sign that justifies a check.
• A small office keeping a customer list and contact details. This is usually not the situation the law had in mind as requiring an appointment, but the law's other obligations remain.
• A company that transfers or sells mailing lists. If this is a core activity, it may fall in the group obliged to appoint.

The examples illustrate that there is no simple rule by size or sector. The check has to be specific to each organization, based on what the organization actually does with the information.

And if the duty does not apply?

An organization that need not appoint an officer is still subject to other privacy obligations: a privacy policy, information security, notice to the people who provided the information, and the right to inspect and correct it. Many organizations choose to appoint an officer voluntarily, so that someone understands the field, documents decisions and keeps management informed.

Internal or external officer

The organization can appoint an employee to the role or use an external provider. Each route involves considerations: professional knowledge, conflict of interest, availability and cost. If it is an employee, they should not hold another role that creates a conflict of interest with the officer's role. A comparison of the options will be covered in a separate article.

What to do in practice when characterizing the organization

• Map the information. Which databases exist, what is in them and who accesses them.
• Check how the information is classified. Sensitive information carries stricter requirements.
• Document the check. Even when the conclusion is that no appointment is required, keep the reasoning in writing.
• Update the privacy policy and procedures. Not only because of the officer question, but also in light of the amendment's other requirements.
• Get advice in time. When in doubt, it is better to ask before an incident arises.

Common mistakes

• Assuming that only large companies are required to appoint, without considering that the way an organization operates often calls for an appointment.
• Assuming the duty does not apply simply because you do not hold a "database" in the narrow sense.
• Appointing an officer in name only, without authority, time and management support.
• Not documenting the decision whether or not to appoint.

In summary

Whether you must appoint a data protection officer depends on the type of organization, the information it holds and the nature of its activity. It is worth checking and characterizing this in an orderly way, documenting the characterization and the conclusion. If you are not sure whether the duty applies to you, you are welcome to contact us for an initial review. The information in this article is general and is not legal advice.