According to Article 37 of the GDPR, the presence of an inspector on the staff is mandatory in three cases:
Public authority or institution
When processing is carried out by a public authority or institution, with the exception of courts in the administration of justice.
Monitoring of data subjects
When the main activity of the company is related to the systematic and regular monitoring of data subjects on a large scale.
Special categories of personal data
When companies process large amounts of special categories of personal data (for example, biometric and genetic data).