Does an NGO need a DPO?

It depends on what your organisation does with people’s data, not on how big it is. This guide gives the test in the GDPR, shows how it reads for aid and development work, and sets out what to do whichever way you land.

The short answer

An NGO must appoint a data protection officer (DPO) if its core activities involve regular and systematic monitoring of people on a large scale, or large-scale processing of sensitive data such as health, ethnicity or religion. Many humanitarian organisations meet the second test. Other NGOs may appoint one voluntarily, and funders often ask who is accountable.

What the GDPR says

Article 37(1) of the GDPR lists three cases in which a controller or a processor must designate a DPO. Only the last two matter for most NGOs.

A public authority or body: What it means: Acting as a public body, not just working with one. What it can look like in NGO work: Rare for an NGO. Some bodies you work with fall in this case, which does not make you one.
Regular and systematic monitoring on a large scale: What it means: Following people over time, in an organised way, as a core activity. What it can look like in NGO work: Biometric checks at every distribution. Tracking supporters’ behaviour across a large donor base. Location tracking of programme participants.
Large-scale processing of special categories or criminal data: What it means: Health, ethnic origin, religion, political opinion, sexual orientation, biometric or genetic data, trade union membership, or criminal convictions. What it can look like in NGO work: Patient records in a clinic programme. Protection case files. Registration of refugees or displaced people that records ethnicity or religion.

The words that decide the question are “core activities” and “large scale”. Core activities are what you exist to do, not the back-office work that supports it. A hospital NGO’s patient records are core. Its payroll is not.

What counts as large scale

The GDPR gives no number. The guidelines on data protection officers, written by the Article 29 Working Party and endorsed by the European Data Protection Board, name the factors to weigh:

The number of people concerned, as a figure or a share of a population.
The volume of data and the range of items processed.
How long the processing lasts.
How far it reaches geographically.

Those guidelines treat the patient records of a hospital as large scale and those of a single doctor as not. A programme that registers thousands of people and records sensitive information about each of them sits closer to the hospital than to the doctor, even if your organisation has twenty employees. Staff numbers are not part of the test.

If you decide you are below the threshold, write down why. An auditor or a funder will ask, and the written reasoning is your answer.

Does the GDPR apply to you?

It applies to processing done in the context of an establishment in the EU, wherever the people concerned live. An NGO with a head office in Europe and field operations in Africa, Asia or the Middle East is covered for the data of the people it serves there. It also applies to an organisation outside the EU that offers services to, or monitors the behaviour of, people in the EU.

National law can go further. Germany, for instance, requires a DPO once twenty or more people are regularly engaged in automated processing of personal data, whatever the type of data. Check the law of every country where you are established. Countries outside the EU have their own data protection laws, some with their own rules on a DPO, and funders often write the GDPR standard into their grant conditions.

If you are not required to appoint one

You can still appoint one, and for a growing NGO it is usually the sensible choice. A DPO gives you one accountable person for breaches, requests from the people you serve, assessments of new systems and questions from donors. Many funders and partners ask about it in due diligence.

There is one trap. The European guidelines say that if you appoint a DPO voluntarily, the same rules apply to that person as to a mandatory DPO: independence, access to top management, protection from dismissal for doing the job. If you want the benefits without those obligations, give the role another name, such as data protection lead or privacy adviser, and make clear that it is not a DPO under the GDPR.

What a DPO must be and do

Articles 37 to 39 set the frame.

Expert knowledge of data protection law and practice, in proportion to the sensitivity of what you handle.
Independence. The DPO gets no instructions on how to do the job and cannot be dismissed or penalised for doing it.
A direct line to the highest level of management.
Enough time and resources to do the work, including access to the people and systems they need to see.
Published contact details, given to the supervisory authority and available to the people whose data you hold.
Tasks: inform and advise the organisation and its staff, monitor compliance, advise on data protection impact assessments, cooperate with the supervisory authority and act as its contact point.

The DPO is not personally liable for your compliance. The organisation, as controller, is.

The conflict of interest rule

Article 38(6) lets the DPO do other tasks, but not ones that would have them decide why and how personal data is processed. In practice the executive director, the head of IT, the head of HR and programme managers cannot be your DPO. Small NGOs often hand the role to the office manager or the IT person. That is the arrangement most likely to be challenged.

Your options

An employee as DPO: Fits: Large organisations with enough work to fill a role. Watch for: Conflict of interest, and keeping their knowledge current
An external DPO under a service contract: Fits: Small and medium NGOs, and organisations working in many countries (Article 37(6)). Watch for: A clear scope, response times and a named contact who understands field work
One DPO for a group: Fits: Federations and networks. Article 37(2) allows one DPO for a group if they are easy to reach from each establishment. Watch for: Language, time zones and who holds the contact details for each entity
No DPO, with a written decision: Fits: NGOs below the threshold. Watch for: Review the decision whenever your activities change

An external DPO can be based in another country. What matters is that people and the authority can reach them easily, in a language they use.

What is at stake

Failing to meet the DPO obligations can lead to an administrative fine of up to €10 million or 2% of worldwide annual turnover, whichever is higher (Article 83(4)). For most NGOs the more likely exposure is practical: a funder’s due-diligence check that finds nobody accountable, or a breach where nobody knows who decides what to do next.

Five steps to decide

List what you process about people: who, what kinds of data, how many, for how long, and in how many countries.
Mark the sensitive items and the activities that follow people over time. Ask whether they are core to your mission.
Weigh the scale using the four factors above, and check the national law where you are established.
Decide, and write the reasoning down with the date and the name of the person who approved it.
If you appoint a DPO, choose the model, check for conflicts of interest, publish the contact details and notify the supervisory authority. If you do not, put a date in the diary to review the decision.

How DP4G can help

DP4G is Relief Applications’ service for organisations that need a DPO who understands humanitarian work. We act as your external DPO, month by month, or run a one-off audit first so you can see where you stand. Start with a free audit or a call: no commitment at that stage. See the DP4G service for the plans, and read our guide to data protection impact assessments, the task every DPO ends up advising on.

Questions and answers

Does a small NGO need a DPO?

Size does not decide it. A small NGO that registers many vulnerable people, or handles health or protection case files at scale, can be required to appoint one. A small NGO that only holds staff records and a donor mailing list usually is not.

Can a board member, a volunteer or the executive director be our DPO?

Not if they decide why and how personal data is processed. A person in a governance or management role has that decision power, so they would be in a conflict of interest. A volunteer can hold the role only if they meet the expertise and independence requirements and can give it enough time, which is hard to guarantee.

Do we have to tell the authority who our DPO is?

Yes. You publish the DPO’s contact details and communicate them to the supervisory authority (Article 37(7)). Most authorities have an online form for it.

Is the DPO responsible if we get it wrong?

No. The organisation is responsible for compliance. The DPO advises and monitors, and the organisation decides.

Can the same person be DPO for several organisations?

Yes, for a group of related entities if they are easy to reach from each of them, or as an external service provider for separate organisations, as long as there is no conflict of interest and enough time for each.

What if we work with no EU office?

The GDPR can still apply if you offer services to, or monitor, people in the EU. Many funders and partners also ask for GDPR-level practice in their agreements, and the country where you work may have its own data protection law.

Not sure where you stand?

Start with a free audit. We map your data and tell you in writing, within five working days, whether you need a DPO and what to do next.

Start your free audit

Keep reading

DPIA for NGOs: when you need one, how to do it, and a template: The assessment your DPO will ask for before a risky new system.
ERP for NGOs: a buyer’s guide: With a chapter on the data protection checks.
DP4G, an external DPO for humanitarian organisations: Plans, audits and the team.
Case study: a data privacy study for Diakonie Katastrophenhilfe: Concrete guidelines and tools for staff on the ground.

This guide is general information based on the GDPR and the European guidelines on data protection officers. It is not legal advice, and national laws differ. Reviewed on 11 November 2026 by the DP4G team at Relief Applications.