Dyann Heward-Mills explains when the appointment of a DPO is — and is not — mandated by the GDPR.