I'm struggling to understand why that's unclear. Is it the use of "public authority or body"?
He's not handling sensitive personal data.
He doesn't need a DPO.
See also the derogation for micro companies:
https://gdpr-info.eu/recitals/no-13/
> To take account of the specific situation of micro, small and medium-sized enterprises, this Regulation includes a derogation for organisations with fewer than 250 employees with regard to record-keeping.
How do you guaranty that nothing in the messages being handled by the server is "sensitive personal data".
Example: Parts of our software run on customer servers and as such they are processing data in their control and not ours, hence can for example used to filter out personal data before they are then sent to our servers, without causing any GDPR related triggering of sending personal information to a third party (our company).
> How do you guaranty that nothing in the messages being handled by the server is "sensitive personal data".
You guarantee it by reading the rest of GDPR. It defines sensitive personal data separately than personal data. Sensitive personal data is defined by GDPR to be things that can be used to discriminate against the individual, such as race, ethnicity, religion, health information, credit information, age, etc.
EDIT: And what I mean to say is that if the messages aren't passing through the server or being stored on the servers, then the only info being handled by the server is the meta-data including IP address, which is not included in GDPR's definition of _sensitive_ personal data.
Sounds to me like they are not a) processing b) collecting message data.