Under GDPR, appointing a DPO is mandatory for public authorities and organizations whose core activities involve large-scale, regular, and systematic monitoring of individuals or large-scale processing of sensitive personal data. Even if not legally required, many businesses choose to appoint a DPO to ensure comprehensive data protection practices.