Data concerning sex life or sexual orientation Please note: Even if a DPO is not necessary according to the aforementioned requirements, it can be useful to designate one on a voluntary basis. 2. Can EU member states adopt national rules for the designation of a DPO? Yes, according to Art. 37 (4) GDPR. The national specific requirements may even be more restrictive as under the GDPR. In Germany, a DPO needs to be designated under the new Federal Data Protection Act ("BDSG") if At least 20 persons are constantly dealing with automated processing; or Processing is subject to a Data Protection Impact Assessment (Art. 35 GDPR); or