Does a small Irish business need a Data Protection Officer?

Article 37(1) of the GDPR requires a business or organisation (a controller or a processor) to appoint a Data Protection Officer in three cases. The first is where a public authority or body does the processing, except courts acting as courts. The second is where the business's main work (its core activities) consists of processing that, by its nature, scope or purposes, requires regular and systematic monitoring of people on a large scale. The third is where its main work consists of processing, on a large scale, of sensitive data such as health data (the special categories in Article 9), or of personal data about criminal convictions and offences. The Data Protection Commission's page on DPOs sets out the same three cases.

In the third case either kind of data is enough: the text first published in 2016 said "and", and a correction (corrigendum) published on 23 May 2018 changed it to "or". EU or national law can add further cases (Article 37(4)). Section 34 of the Data Protection Act 2018 lets the Minister add them by regulation, and none has been made.

Separately, Irish law ties a DPO to a step in health research. The Health Research Regulations 2018 (S.I. No. 314 of 2018), made under section 36(2) of the same Act, let an organisation doing health research apply for a declaration that people's explicit consent is not required. The test is that the public interest in the research significantly outweighs the public interest in requiring consent. Under Regulation 5(4)(c)(vi) the application must show that a data protection officer has been appointed in relation to the research. The amending regulations of 2019 and 2021 left that condition in place. See the health research rules.

Outside those cases, and that research application, a DPO is optional. A salon, an accountant or a shop with ten staff is not a public authority or body, so the question turns on two phrases: core activities, and large scale. On our reading of the European regulators' examples, none of those businesses needs one, as the table further down shows. The examples do not name them. A health practice needs a closer look, because health data is part of its core activity.

The 2018 Act's own definition of a public authority includes a person providing a health or personal social service on behalf of the Health Service Executive (HSE), under an arrangement made under section 38(1) of the Health Act 2004. A practice in that position should take advice on the first case. This guide does not say which HSE contracts are such arrangements. The regulators' guidelines, described below, also recommend, as good practice, that private organisations carrying out public tasks designate a DPO even where the law does not require one.

The examples come from the guidelines on DPOs of the Article 29 Working Party, the group of EU regulators before the European Data Protection Board (WP243 rev.01, last revised on 5 April 2017). The Board endorsed them on 25 May 2018. They are the regulators' reading of the law, not the law itself. On 16 October 2026 the Board's list of endorsed guidelines showed no replacement for them. The Board's work programme for 2026 and 2027, adopted on 11 February 2026, includes a targeted update of the DPO guidelines, and none had been published by that date.

Breaking the DPO rules can be fined. They sit in Articles 25 to 39, which Article 83(4)(a) puts in the lower tier of fines: up to €10 million or, for a business (an undertaking), 2% of total worldwide annual turnover of the preceding financial year, whichever is higher.

Recital 97 of the GDPR says core activities are a business's main activities, not processing of personal data as a side activity (an ancillary activity). The guidelines add that processing which cannot be separated from the business counts: a hospital cannot provide care without patient records, so hospitals must appoint a DPO. The GDPR defines neither large scale nor regular and systematic monitoring, and the guidelines say no single number for large scale could work in all situations.

The sentence that an individual doctor, other health professional or lawyer is not processing on a large scale comes from Recital 91, which is about data protection impact assessments, not DPOs. The guidelines borrow it for Article 37, note that some of it may not carry over in exactly the same way, and say that between an individual physician and a whole country's data lies "a large grey zone".

The monitoring examples below are activities that may amount to regular and systematic monitoring. Each still has to be a core activity, on a large scale, before Article 37 requires a DPO.

Article 37 applies to suppliers that handle data for a business (processors) as well as to the business itself (the controller), and the two can fall on different sides of it. The guidelines' example is a small family business selling household appliances in a single town, using a processor whose core activity is website analytics and help with targeted advertising. The family business, with few customers and limited activities, is not processing on a large scale and need not designate a DPO. The processor serves many businesses like it, so it is processing on a large scale and must appoint one under Article 37(1)(b). A supplier's Article 37 duty stays with the supplier.

Section 34 of the Data Protection Act 2018 lets the Minister, after consulting the Data Protection Commission, make regulations requiring classes of controllers or processors to designate a DPO under Article 37(4).

The Irish Statute Book's directory for the Act, updated to 6 October 2026, lists the statutory instruments made under it, section by section. None is made under section 34. The health research regulations are listed under section 36(2). Article 37 says nothing about how many staff a business employs, and no regulation under section 34 has added a staff threshold.

The European Commission's Digital Omnibus proposal of 19 November 2025 would amend several articles of the GDPR, including the breach and impact assessment rules, and would leave Articles 37 to 39 as they are. On 16 October 2026 the European Parliament's file for it showed it awaiting a committee decision. The DPO guidelines are due a targeted update under the Board's work programme, and until it is published the Board's DPO page points to WP243 rev.01.

Here is how the tests apply to four businesses of about ten people. The rows apply the guidelines' factors and examples. The guidelines do not mention salons, accountants or shops by name.

Write the decision down even when the answer is no. The guidelines recommend documenting the analysis unless it is obvious that no DPO is needed, and updating it when the business takes on new activities or services. The DPC's GDPR guidance for SMEs asks: if it is decided that a DPO is not required, have you documented the reasons why? A short note will do: the three cases, why each does or does not apply, the date, and what would make you look again.

The business does. Article 24(1) makes the business responsible for complying with the GDPR and for being able to show it, and Article 5(2) makes it accountable. The guidelines say that stays true where there is a DPO: a DPO is not personally responsible if the business does not comply.

Name one person who owns the work below, with a deputy for when they are away. The guidelines say a business without a DPO is free to give data protection tasks to staff or outside consultants, and that it should be made clear, inside and outside the business, that their title is not Data Protection Officer.

When somebody raises a concern with the DPC, its 2025 annual report says it generally deals directly with the organisation, through its DPO where one has been appointed. Without one, your named person answers. The dates they keep are in the compliance clocks.

Article 37(5) says the DPO is chosen for professional qualities, in particular expert knowledge of data protection law and practice. The DPC's guidance on qualifications says the GDPR prescribes no particular qualification or training, and that the expertise should match how complex, large and sensitive the processing is.

Article 37(7) requires the DPO's contact details to be published and given to the DPC. The DPC's register FAQ, updated in February 2026, says to notify it once, with no fee, through the online form linked from its DPO page, by email or by post. Any change must be notified too. An outsourced DPO must still be notified. The published details need not name the DPO, though the guidelines say giving the name to the DPC is essential.

A business without a DPO has nothing to register. The same FAQ says a business cannot register with the DPC as a controller. The fee-paying registration under the old Acts no longer exists, and privacy notices that say a business is registered with the DPC should be corrected.

The DPC's 2025 annual report says it had been notified of 4,218 DPOs by the end of 2025, 3,578 of them in the private sector. It says failing to support and resource a designated DPO adequately is an infringement of the GDPR, and that it carried out supervisory examinations of DPO resourcing in 2025 and will continue in 2026.

Once a DPO is appointed, Article 38 sets the terms. Involve them properly and in good time in every data protection issue. Give them the resources and access they need. Give them no instructions on how to do the tasks, and do not dismiss or penalise them for doing them. They report directly to the highest level of management. People can contact the DPO about their data and their rights, and the DPO is bound by confidentiality. The guidelines add that the DPO must be consulted promptly once a breach has occurred. Article 39 sets the minimum tasks:

Article 38(6) lets a DPO have other duties, provided they do not result in a conflict of interests. The guidelines say the DPO cannot hold a position where they decide why and how personal data is used (the purposes and means of processing). Their rule of thumb lists senior management, such as the chief executive or the heads of marketing, human resources or IT, and roles lower down where the job includes those decisions.

The Court of Justice said the same in X-FAB Dresden (C-453/21, 9 February 2023): a DPO cannot be given tasks that would have them deciding the objectives and methods of processing, because their job is to review those independently. Whether a conflict exists is for the national court to decide case by case, on all the circumstances.

In a business of ten, the owner, the practice manager and whoever chose the booking or patient system may be the people deciding what data is collected, why, and in which system. Where they are, each of them may have a conflict on the guidelines' rule of thumb, and the Court leaves the question to be decided case by case. That leaves few safe choices for the role inside a small business. Instead, Article 37(6) allows an outside DPO under a service contract.

Take advice when one of the cases may apply: a health practice whose scale puts it in the grey zone, a business whose product is tracking, profiling or monitoring people, or a provider holding health or monitoring data for many clients. A practice planning a health research consent application needs a DPO for that research before it applies.

The guidelines say an outside firm can act as DPO as a team, provided each member meets the requirements and has no conflict of interests. They recommend one individual as the lead contact for each client. A conflict can arise if an external DPO is asked to represent the business in court on a data protection matter.

A solicitor is the person for the legal question itself: whether the tests are met on your facts, a dispute with a customer or an employee, or an inquiry by the DPC.

FourWinds does not act as a Data Protection Officer for any business, and does not give legal advice. A DPO's job includes monitoring the processing (Article 39(1)(b)). Where we build or run the systems that hold a client's data, that would mean checking our own work. What we do build is the record of processing and the statutory deadlines that your named person works from.