That's not true. The Data Protection Officer doesn't need to be a dedicated person, an employee can simply be given that role in addition to their regular roles. There are rules to prevent a conflict of interest. But I don't think many small corporations have a dedicated DPO.