This is incorrect - if you have more than 10 employees that handle data, and that basically means everyone sitting behind a computer, your company has to designate someone as data privacy officer who has to make sure that things get handled according to GDPR.

These rules arent strictly enforced yet, but when you run into issues and it can be shown that you didn´t take steps to implement it, it has consequences.

No, you need people be handling personal data, not any data.

That's not what the GDPR says. There's no bright line for the number of employees handling data.

A DPO should be assigned if:

>(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;

>(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their nature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale; or

>(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of data pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.

(Article 37)

And in any case a data protection officer is different from a representative, as the title of Article 27 indicates ("Representatives of controllers or processors not established in the Union").