DPO designated if processing triggers Art. 37 requirements

GDPR Art. 37 mandates designation of a Data Protection Officer for public authorities, organizations engaged in large-scale systematic monitoring, or those processing special category data at scale. Most B2B and B2C SaaS products do not meet these thresholds — but the absence of any privacy contact creates a separate problem: Art. 13(1)(b) requires controllers to provide contact details for the DPO or, where no DPO exists, the controller itself. If data subjects have no documented way to reach someone about privacy matters, they cannot exercise their Art. 15–22 rights in practice. A privacy email address in the footer is minimal but required; not having one is independently sanctionable.

Document the Art. 37 assessment and ensure a privacy contact is accessible in the privacy policy, even if formal DPO designation is not required.

## DPO Assessment — Art. 37 GDPR
Date: 2026-02-22

- Public authority or body: No
- Core activities = large-scale systematic monitoring: No
  (Analytics are product-incidental, not the core business)
- Core activities = large-scale special category data: No

Conclusion: DPO designation not mandatory.
Voluntary privacy contact: privacy@example.com
(We aim to respond to all privacy inquiries within 30 days.)

Store this in docs/dpo-assessment.md. Publish privacy@example.com in your privacy policy under a 'Contact Us' section. If your application later expands into health data processing or systematic behavioral profiling at scale, re-evaluate the Art. 37 threshold and register the DPO with your national supervisory authority if required.