When must a UK organisation appoint a data protection officer?

A DPO is mandatory for public authorities, for organisations whose core activities require regular and systematic monitoring of individuals on a large scale, and for those whose core activities consist of large scale processing of special category or criminal offence data. The DPO must report to the highest level of management, be free from instructions on how to carry out the role and must not be dismissed for performing it. Organisations outside the test may appoint one voluntarily, but then the same requirements apply.