Which institutions/enterprises must appoint a personal data protection officer?

The extent of the processing must be assessed by the company, for example, based on:

• number of persons that the company registers or plans to register information about - either based on a certain number or based on a proportion, for example, of the population,

• the amount of personal data and/or types of different personal data that are processed,

• the duration of the processing operation or the storage period of the information,

• geographical boundaries of the processing operation.