These rules arent strictly enforced yet, but when you run into issues and it can be shown that you didn´t take steps to implement it, it has consequences.
A DPO should be assigned if:
>(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;
>(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or
>(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.
(Article 37)
And in any case a data protection officer is different from a representative, as the title of Article 27 indicates ("Representatives of controllers or processors not established in the Union").
Noone said that accounting needs not be done, just that you don't have to employ anyone you listed in a startup. You do as with any other non-essential work like cleaning, catering and so on: buy external services on the need to have basis.
This is also not something in any way unique to Europe. American start-ups also need to file taxes, incorporate and so on.
and Europe tax return are far more convoluted than the average Delaware company, especially because of bullshit like vatmoss schemes that are a specific result of the European market fragmentation, which was the main point to begin with