A DPO is only mandatory if the core activities of your business include regular and systematic monitoring of individuals on a large scale, or include the processing on a large scale of specially protected information.

A shop only processes personal data as a secondary activity, with their core activity being selling merchandise. The data they do process is not in a specially protected category under the GDPR and pertains only to their business rather than the wider lives of their customers. They do not need a designated DPO.

A social media network, an ad tech company or a credit reference agency does need a DPO. A manufacturer of IoT gadgets that constantly phone home with a stream of usage data almost certainly needs a DPO. If the IoT gadget I sold you tells me what time you get home from work and what time you go to bed, that sounds an awful lot like "regular and systematic monitoring". A manufacturer of IoT gadgets that only phone home occasionally with fully anonymised error logs probably doesn't need a DPO.

This sounds pretty reasonable - I misjudged how bad the DPO requirement was. Thanks for explaining it to me!

Keeping things for tax purposes requires no consent, same for anything you are legally required to keep record off. Video cameras most certainly fall under legitimate interest (as long as you follow the law about using surveillance in your country).

From what I recall on the info I've seen locally is that you don't need a DPO until you hit 250 employees.

The core activities of a small shop do not consist of data processing operations which require monitoring people.

The core activities of a small shop include some data processing operations that don't require monitoring people (e.g. records of what they sell), and an anti-robbery video camera isn't a core activity of their business; I'd even assume that it's not looked at most of the time and is even more likely to be outsourced to some security company (which would have a DPO).