What happens if you do not appoint a DPO when required?
Last updated 12 November 2026. General information only, not legal advice.
If your organisation is required to appoint a Data Protection Officer (DPO) and does not, it is in breach of Article 37 of the GDPR. The Data Protection Commission (DPC) can use its corrective powers, including reprimands and orders to comply, and the breach falls within the GDPR fine tier of up to €10 million or 2% of worldwide annual turnover, whichever is higher. In practice, the DPC’s approach so far has been to contact organisations and push them into compliance, but persistent non-compliance has led to formal inquiries.
Which rules are you breaking?
A DPO is mandatory under Article 37(1) GDPR where you are a public authority or body, where your core activities involve regular and systematic monitoring of individuals on a large scale, or where your core activities involve large-scale processing of special-category data (such as health data) or criminal convictions data. Our guide Data Protection Officer in Ireland: do you need one? walks through these tests.
Failing to appoint is not the only way to fall short. Article 37(7) also requires you to publish your DPO’s contact details and communicate them to the DPC, which you do through the DPC’s online DPO notification form. Articles 38 and 39 also require the DPO to be properly involved, resourced and free of conflicts of interest, so appointing someone in name only can still be a breach.
What can the Data Protection Commission do?
Under Article 58(2) GDPR, the DPC can issue a reprimand, order you to bring your processing into compliance within a set period and impose an administrative fine. Article 83(4)(a) places breaches of Articles 25 to 39, which include the DPO rules, in the lower fine tier: up to €10 million or, for an undertaking, up to 2% of total worldwide annual turnover for the preceding financial year, whichever is higher. The DPC weighs the Article 83(2) factors, such as how serious and long-running the breach was and how well you co-operated.
The DPC has actively checked DPO compliance. Its enforcement programme covered public bodies from 2020 and private hospitals, GP out-of-hours services, banks and credit unions in 2021; by November 2021 more than 170 additional organisations had come into compliance after DPC intervention.
One public body that did not respond was the subject of an own-volition inquiry. In its May 2022 decision on the Pre-Hospital Emergency Care Council, the DPC found breaches of Article 37(1) (no DPO designated), Article 37(7) (contact details not published or notified) and Article 31 (failure to co-operate with the DPC), and issued a reprimand. No fine was imposed in that case, but fines remain available for the same breaches. For a wider view of how penalties are set, see our guide to GDPR fines in Ireland.
Knock-on risks for your business
A missing DPO often comes to light through a breach notification, a complaint or a client’s due-diligence questionnaire. Without one, nobody may be monitoring compliance or advising on impact assessments, so other gaps are more likely. If you decide you do not need a DPO, it is good practice to record your reasoning, since the DPC has asked organisations that chose not to designate one to explain why.
Need help with this? Plus Promotions Limited provides an outsourced DPO service for Irish businesses, from €750 per month. It is compliance consultancy, not legal advice.
Frequently asked questions
Is there a fine for not appointing a DPO in Ireland?
Yes, a fine is possible. Breaching Article 37 GDPR falls within the fine tier of up to €10 million or 2% of worldwide annual turnover, whichever is higher. The DPC decides case by case using the Article 83(2) factors and can also issue a reprimand or an order to comply.
Do you have to tell the Data Protection Commission who your DPO is?
Yes. Article 37(7) GDPR requires you to publish your DPO’s contact details and communicate them to the DPC. The DPC provides an online form for DPO notifications.
What if we decided we do not need a DPO?
If the Article 37(1) tests do not apply, appointing a DPO is optional. Keep a written record of how you reached that decision and review it if your processing changes, for example if you start processing health data or monitoring people on a large scale.
OnlineLegalServices.ie is not a solicitor’s practice and does not give legal advice. Our data protection services are compliance consultancy. For legal advice on your own situation, speak to a solicitor.
