am I required to appoint a DPO for my company

For most SMEs and self-employed professionals, there is no obligation

A Data Protection Officer, abbreviated DPO, is for ordinary SMEs and most self-employed professionals usually not an obligation. The GDPR lists a number of specific situations in which a DPO is required, and outside of those, an organization is free to appoint one itself, without the law requiring it. In practice, a mandatory DPO mainly applies to public authorities and to companies whose core activity consists of large-scale, systematic monitoring of people or the large-scale processing of special categories of personal data, such as health data.

An online shop, a consultancy, a contractor or a self-employed person with a bookkeeping package and a couple of SaaS tools falls in most cases outside those categories. That does not mean there is nothing to do: even without a DPO, the obligation applies to be able to demonstrate which personal data is processed and for what purpose, for example in the processing register, and that obligation applies equally to a sole proprietorship. Anyone in doubt as to whether their own activities fall within the category "large-scale" or "systematic", will find more guidance in the question when a DPIA is required, because that same risk assessment often comes up together with the DPO question.

What this is based on: Article 2 and 30 GDPR

The GDPR determines in Article 2 the material scope of the regulation, and Article 30 regulates the records of processing activities with the exceptions that apply to it — the DPO obligation itself is located elsewhere in the regulation, but the scope and nature of the processing that play a role there align with the same criteria as the records and the DPIA obligation. Part of this assessment is factual: how many people are monitored, how systematically, and what kind of data is involved. The Dutch Data Protection Authority publishes further guidance on this for Dutch practice, while the question of whether a DPO is required is based everywhere in the EU on the same regulation — the national supervisory authority, in the Netherlands the Dutch Data Protection Authority and in other Member States the supervisory authority of that country, may apply their own guidance or additional registration requirements around the appointment of a DPO.