Many organisations do, and it is worth appointing one even where it is not compulsory.
A Data Protection Officer is required where your core activities involve regular and systematic monitoring of individuals on a large scale, or large scale processing of special category data, and for public authorities.
Plenty of smaller organisations fall outside that and still appoint one, because it gives a single accountable point of contact and is the clearest evidence that data protection is being taken seriously.
The DPO must be able to act independently, report to the highest level of management, and must not be in a position where they would be marking their own homework. The head of IT or the head of marketing supervising their own processing is the classic conflict.
A DPO can be an existing employee wearing a second hat, provided the independence and conflict requirements are genuinely met. Once appointed, you publish their contact details and inform the Data Protection Office.