When it makes sense
When it is an organisational requirement, when there is regular processing of personal data, when the organisation needs to strengthen governance, receives requests from clients or data subjects, or does not have sufficient in-house data protection expertise.
