Why have you isolated one element from a multiple element sentence:

If

* core activities * require * large scale * regular * systematic

If you tick all those other boxes, but are concerned that your processing may be teetering on the boundary of 'large scale', I would be cautious and assume your liable.

These are excellent questions that you will have to have shown you've considered if you get audited. If there's disagreement with the regulator, you'll come together to resolve it, and then may need to appoint one.

Monal is an XMPP client running on user's iOS devices. Is that person even running an XMPP server for those users?

A UK privacy attorney I know considered 20k records (individuals) to be large scale. I haven't seen much helpful guidance. The WP29 guidance I've read only gives examples at the very extremes of large and small so not too helpful. Practical guidelines will evolve over time.

I guess if you have to ask that question you are not a large scale.