GDPR.ME.UK · WORKING DOCUMENT 76

DPO necessity, representative and fee decision memo

Make three separate decisions: DPO requirement, territorial representative requirement and annual data protection fee. A fee registration is not a compliance certificate.

Document edition 2 · 1 November 2026 · Adapt to your processing and evidence. Use references rather than personal records.

Use alongside the dpo and ico fee guide and evidence-to-action method.

Record details

Organisation or activity reference

Responsible owner or role

Record reference and version

Review date

1. Describe the organisation and core activities

Identify legal entities, establishments, controller/processor roles and the main activities that achieve the organisation’s objectives.
Describe monitoring and sensitive processing, including numbers of people, volume, range, geographical reach and duration.
Distinguish core activities from ancillary internal functions such as ordinary payroll.

Organisation / entities / establishments

Public-authority status and basis

Core activities and roles

Monitoring nature / regularity / scale

Special-category / criminal-offence processing and scale

Evidence and assumptions

2. Decide whether a DPO is required

Assess each Article 37 trigger and record the conclusion. Do not infer large scale from a single numeric threshold.
If appointing voluntarily, apply the same DPO role requirements. If no DPO is required or appointed, identify an adequately resourced privacy lead.
Set review triggers for growth, monitoring, new sensitive services and changes in public-authority status.

Article 37 trigger-by-trigger assessment

Required / voluntary / not required decision

Reasoning and evidence

Privacy lead if no DPO

Decision approver and date

Review triggers and date

3. Assess independence and appointment arrangements

Check whether the proposed DPO determines processing purposes or means in another role. Evaluate actual responsibilities rather than job title alone.
Document resources, competence, reporting to the highest management level, access to processing and protection of independence.
Record contact publication and regulator notification steps where applicable; keep actual appointment evidence.

Proposed DPO and qualifications

Other duties and conflict analysis

Reporting line / resources / access

Terms and independence provisions

Contact publication and notification record

Appointment evidence / review owner

4. Check the annual fee

Use the current official self-assessment and the full exemption conditions. Staff administration, marketing and accounts are not the only statutory categories.
Record turnover, staff calculation and any special organisational rules before selecting a tier. Current published tiers are £52, £78 and £3,763, subject to checking at the decision date.
Record payment and renewal evidence. If claiming exemption, state the precise factual basis and review it when processing changes.

Assessment date and official tool outcome

Turnover / staff / organisational category

Fee tier or exemption with reasons

Annual fee and payment method

Registration / payment evidence

Renewal owner and date

5. Assess representative duties separately

For organisations without a UK establishment, assess UK targeting or monitoring and Article 27 conditions and exemptions.
For UK businesses operating under EU GDPR, assess the EEA establishment, targeting and monitoring position separately, using appropriate EU sources or advice.
Distinguish a representative’s written mandate from the independent DPO role.

Applicable regime and territorial scope

Establishments / targeting / monitoring

Representative required? Reasoning

Exemption analysis if relied upon

Written mandate and contact details

Notice updates and review date

6. Record approval and actions

Summarise the three decisions separately and identify unresolved facts.
Assign actions for appointment, conflicts, publication, registration or renewal; verify completion.
Review material changes to operations and legal requirements.

DPO decision

Representative decision

Fee decision

Action / owner / deadline / evidence

Approver and date

Next review and change triggers

Sources and completion

Record who reviewed and approved the document. Save a working copy to reopen it later, or export the completed HTML record. Your entries stay in this page; automatic storage is not enabled. A downloaded record may contain sensitive operational information.

The template does not verify facts, perform an audit, submit a notification or execute a contract.