Does the DPO need to be an employee of the company?

No. The DPO can be an employee, a director, or an external third-party service provider — the PDPA requires a designated individual or team accountable for data protection, not necessarily an in-house hire.