Do your AI tools mean you need a data protection officer? A GDPR Article 37 check sheet for small businesses
What you get: a finished DPO check sheet: a six-question test from Article 37 GDPR and the official DPO guidelines, an 8-column sheet with one row per AI tool and a result formula, a German add-on for Section 38 BDSG, three filled example rows, and a one-paragraph decision record to keep with your records. Copy the tables into a spreadsheet and you are done in about 20 minutes.
Short answer: using an AI tool does not by itself mean you need a data protection officer. You need one when a core activity monitors people regularly and systematically on a large scale, or processes health or criminal-offence data on a large scale, or when national law (for example Germany's) says so.
Step 1: the six-question test
| Question | Source | Answer |
|---|---|---|
| 1. Are you a public authority or body (courts acting in their judicial capacity excepted)? | Art. 37(1)(a) | Y / N |
| 2. Is the AI tool part of a core activity: a key operation you need to reach your business goals, or processing that is an inextricable part of it? Payroll, standard IT support and office productivity are usually ancillary. | Art. 37(1)(b)–(c); Recital 97; WP243 section 2.1.2 | Y / N |
| 3. Does that activity involve regular and systematic monitoring of people? Examples in the guidelines: email retargeting, data-driven marketing, profiling and scoring for risk assessment (credit scoring, insurance premiums, fraud prevention, anti-money-laundering), location tracking by apps, loyalty programmes, behavioural advertising, wellness and health data from wearables, CCTV, connected devices. | Art. 37(1)(b); WP243 section 2.1.4 | Y / N |
| 4. Does it involve health or other special category data (Article 9) or data on criminal convictions and offences (Article 10)? | Art. 37(1)(c) | Y / N |
| 5. Is it on a large scale? Weigh the number of people (or share of the relevant population), the volume and range of data, how long it runs, and the geographic reach. Not large scale: patient data held by an individual physician, conviction data held by an individual lawyer. | WP243 section 2.1.3; Recital 91 | Y / N |
| 6. Does national law add a case? In Germany: at least 20 persons constantly dealing with automated processing, or any processing that needs a DPIA, or commercial processing for transfer or market or opinion research. | Art. 37(4); Section 38(1) BDSG | Y / N |
Read it this way: Q1 yes, or Q2 and Q3 and Q5 yes, or Q2 and Q4 and Q5 yes, or Q6 yes means a DPO is required. Anything else means not required by law, and you write down why.
Step 2: the check sheet (one row per AI tool)
| Column | What to write | Why |
|---|---|---|
| A. AI tool and what it is used for | [tool, provider] · [e.g. scores leads for the sales team] | Your AI register entry |
| B. Core or ancillary? | Core / Ancillary · one line why | Q2 |
| C. Monitoring? | Y / N · which kind [retargeting, scoring, tracking, profiling] | Q3 |
| D. Special category or criminal data? | Y / N · which [health, biometric, convictions] | Q4 |
| E. Scale | [number of people] · [countries] · [runs since / continuous] → Large / Not large / Unsure | Q5 |
| F. National add-on | Country · Germany: persons constantly on automated processing [n]; DPIA needed Y / N; market research or data trading Y / N → Required / Not required | Q6 |
| G. Result | =IF(OR(AND(B2="Core",C2="Y",E2="Large"),AND(B2="Core",D2="Y",E2="Large"),F2="Required"),"DPO required",IF(E2="Unsure","Ask adviser","Not required: record why")) | Art. 37(1) and (4) |
| H. Decided by, date, review date | [role] · [dd/mm/yyyy] · review when the tool, the use or the volume changes | WP243: document the internal analysis; Art. 5(2) accountability |
Three filled example rows (made-up businesses)
Row 2, a five-person bookkeeping office: A. AI writing assistant drafting client emails · B. Ancillary: supports client service, the business is bookkeeping · C. N · D. N · E. 300 clients, one country, Not large · F. Germany: 4 persons on automated processing; DPIA needed N · G. Not required: record why.
Row 3, an online shop with 60,000 customers in six EU countries: A. AI tool that segments customers and sends personalised retargeting emails · B. Core: sales depend on it · C. Y, email retargeting and profiling · D. N · E. 60,000 people, six countries, continuous: Unsure · F. none · G. Ask adviser. The guidelines list email retargeting and data-driven marketing as monitoring, and the scale is in the grey zone, so get advice and record it.
Row 4, a single-practitioner physiotherapy clinic: A. AI note-taker producing treatment notes · B. Core: health records are inextricable from care · C. N · D. Y, health data · E. 400 patients, one practitioner: Not large (the guidelines' individual physician example) · F. Germany: check your DPIA screening; if a DPIA is needed, a DPO is required regardless of headcount · G. depends on F.
Step 3: the decision record (fill in and keep)
On [date], [role] checked whether [business] must designate a data protection officer under Article 37 GDPR [and Section 38 BDSG]. We are not a public body. Our core activity is [activity]. The AI tools in our register are [core / ancillary] because [reason]. They [do / do not] monitor people regularly and systematically, and [do / do not] process special category or criminal-offence data, on a scale of [number of people, countries]. Result: a DPO [is / is not] required. We will review this when [we add a tool that scores, tracks or profiles people / volumes pass (number) / we start processing health data]. Questions about personal data go to [name or role, email].
If the answer is yes
- Choose someone with expert knowledge of data protection law and practice; a staff member or an outside DPO on a service contract both work (Art. 37(5) and (6))
- Publish the DPO's contact details and send them to your supervisory authority (Art. 37(7))
- Involve the DPO early, give resources, take no instructions on their tasks, let them report to top management, and avoid conflicts of interest, for example the owner acting as their own DPO (Art. 38(1)–(3) and (6))
- Their minimum tasks: inform and advise, monitor compliance and staff training, advise on DPIAs, and act as contact point for the supervisory authority (Art. 39)
If you appoint a DPO voluntarily, the guidelines say the same Article 37 to 39 rules apply to that person. If you would rather not, you can still name a privacy contact without calling them a DPO.
Do this week
- List every AI tool once in your register and fill columns A to F for each
- Mark any tool that scores, tracks, profiles or retargets people; those are the rows that can change the result
- Check whether any tool handles health data (Article 9 check sheet)
- Keep the decision record next to your records of processing and diary a review date
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 5(2), 9, 10, 35, 37, 38, 39, Recitals 91 and 97), the Article 29 Working Party Guidelines on Data Protection Officers (WP243 rev.01, endorsed by the EDPB), and Section 38 BDSG as published in English on gesetze-im-internet.de (check the current German text). Other Member States may have their own rules. Checked on 24 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients often ask "do we need a DPO now that we use AI?". Hand them this sheet with their client AI inventory so the answer is written down. Stay inside your professional rules and refer legal questions on.
Keep the answer next to your AI register
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. List each AI tool once and keep this decision record as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: DPIA screening sheet · Article 22 decision sheet · Article 30 records · Article 32 access and security.
Sources
- Regulation (EU) 2016/679 (GDPR): Articles 37, 38, 39; Recitals 91, 97
- Article 29 Working Party, Guidelines on Data Protection Officers (WP243 rev.01), sections 2.1.2 to 2.1.4
- Federal Data Protection Act (BDSG), English translation: Section 38
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.