Which of the Following Would Require Designating a Data Protection

Which of the following would require designating a data protection officer?

A) Processing is carried out by an organization employing 250 persons or more.
B) Processing is carried out for the purpose of providing for-profit goods or services to individuals in the EU.
C) The core activities of the controller or processor consist of processing operations of financial information or information relating to children.
D) The core activities of the controller or processor consist of processing operations that require systematic monitoring of data subjects on a large scale.