Do I need a data protection officer (DPO)?

For example a municipality, a state institution or a public school. Courts acting in their judicial capacity are exempt.

Core = the activities without which you cannot achieve your main business objective (e.g. a hospital and patient data, an insurer, an advertising network). Supporting activities such as payroll, accounting or routine IT support do not count as core.

For example online tracking and profiling, behavioural advertising, location tracking through an app, loyalty schemes, wearable devices, CCTV systems, smart meters.

Data concerning health, genetic and biometric data, racial or ethnic origin, political opinions, religion, trade union membership, sex life or sexual orientation; data on convictions and offences (Articles 9 and 10 GDPR).

Consider the number of data subjects (in absolute terms and as a share of the population), the volume of data, how long the processing lasts and its geographical reach. Example from the guidelines: a hospital’s patient data — yes; the patients of a single general practitioner — no.