You most likely don't need a DPO: https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Check out the rest of the website, it is pretty helpful.

Don't worry too much, GDPR is both common sense and designed do go after the big companies. Some rules are intentionally vague in order to be hard to circumvent using armies of lawyers and/or technical 'innovations' in exploiting personal data.