This was in one of the earlier drafts of the GDPR but was removed, so you can be required to appoint a DPO if you are a small startup as well, but only if one of the conditions mentioned in article 37 applies to you (which I think doesn't to the OP).