Do you actually need a Data Protection Officer?

Most small and medium businesses don't legally require a formal DPO unless they do large-scale monitoring or process special category data such as health or criminal records as a core activity — but someone still needs to own data protection responsibility even if it's not a full-time role. Document who that person is and what they're responsible for, even informally.

Coach's tip: "we'll figure it out if it ever comes up" isn't a policy — write down who owns it now, before you need the answer under pressure.