A data protection officer ("DPO") must be appointed where:

• processing is carried out by a public authority (other than a court, or tribunal acting in a judicial capacity); or
• the core processing operations of the controller or processor require or involve "large-scale and systematic monitoring of data subjects" or "large-scale processing of special category of data".

The ODPA has issued guidance clarifying the meaning of the terms “large‑scale processing” and “core activity” for the purposes of this assessment, noting that neither term is defined in the GDPR or the DPL 2017. The ODPA also provides guidance on a range of matters relating to the appointment of a DPO, including who may be appointed, the tasks of the DPO, the duties of organisations when a DPO is required, and the level of support that organisations must provide to their DPO.

The ODPA's guidance references the guidance on the appointment of DPOs ("DPO Guidelines") issued by the EU's former advisory body (previously known as the Article 29 Working Party and now replaced by the European Data Protection Board ("EDPB")). The ODPA advises controllers and processors to take into account the terms of both the GDPR and the DPO Guidelines when assessing whether or not a DPO is required to be appointed. It also clarifies that small businesses in Guernsey are, as a general rule, unlikely to be undertaking large-scale processing unless they work with large databases of customers or other types of data subjects. Finally, the ODPA expects controllers and processors to review the scope and nature of processing periodically to ascertain whether or not their prior assessment remains valid or if there are sufficient factors to warrant appointing a DPO. All controllers and processors should document their decision-making and the outcome of such reviews.

In February 2026, the ODPA also prepared a dedicated DPO Zone on its website, which provides practical guidance, tools and resources to support Data Protection Officers and staff fulfilling equivalent responsibilities.

A central feature of the DPO Zone is the DSAR Manager, a structured spreadsheet tool designed to help organisations record, track and manage Data Subject Access Requests (DSARs) efficiently and consistently. The ODPA advises controllers to maintain detailed records of decisions taken during the DSAR process, supported by a clear filing structure and standardised naming conventions. Although the tool is not mandatory, it provides a useful way to evidence compliance, reinforce accountability, and maintain an audit trail of communications and key steps taken throughout the DSAR lifecycle.