Under the GDPR, you must appoint a data protection officer (DPO) if you:

1) are a public authority (except for courts acting in their judicial capacity);
2) carry out large scale systematic monitoring of individuals (for example, online behaviour tracking); or

3) carry out large scale processing of special categories of data or data relating to criminal convictions and offences.