DPO & EU/UK Representative Designation (GDPR Art.37 / Art.27)

GDPR obliges a controller to publish two designations about itself: a Data Protection Officer (Art.37) and, when the controller is not established in the EU or UK but Art.3(2) applies, a representative in the Union and/or in the United Kingdom (Art.27 — the UK obligation is the UK GDPR mirror post-Brexit). These designations feed your privacy notice — Art.13/Art.14 require naming the controller, its representative, and its DPO — and the compliance binder.

This page describes Orbit’s platform controls. It is not legal advice. Whether your organisation must designate a DPO (Art.37(1) trigger conditions) or a representative (Art.3(2) applicability) depends on your processing. Confirm with qualified counsel.

All endpoints below are rooted at https://api.orbit.devotel.io/api/v1/compliance.

The two designations a controller must publish

GDPR Art.37 — Data Protection Officer. The Art.37(1) trigger conditions are: a public authority, core activities involving large-scale systematic monitoring of data subjects, or large-scale processing of Art.9 special-category / Art.10 criminal-conviction data. When any of them applies the controller must designate a DPO, publish the DPO’s contact details, and communicate them to the supervisory authority (Art.37(7)). The DPO may be a staff member or fulfil the tasks under a service contract (Art.37(6) — an external DPO). GDPR Art.27 — EU/UK representative. A controller not established in the Union that nonetheless falls under Art.3(2) (offering goods or services to, or monitoring, data subjects in the Union) must designate in writing a representative established in a Member State where those data subjects are. UK GDPR Art.27 imposes the mirror obligation for a UK representative post-Brexit. Orbit tracks the EU and UK representative designations independently — record each region separately. Also see GDPR Posture Guide for the wider self-documentation sequence.

Endpoints

Get the designation

GET /compliance/dpo-representative — available to any authenticated member of your organisation. Returns the designation plus a completeness block.

curl https://api.orbit.devotel.io/api/v1/compliance/dpo-representative \
  -H "X-API-Key: dv_live_sk_..."

{
  "designation": {
    "dpo": {
      "designated": true,
      "name": "Marie Leclerc",
      "email": "dpo@example.com",
      "phone": "+33 1 23 45 67 89",
      "address": "12 rue de la Paix, 75002 Paris, France",
      "isExternal": false,
      "notifiedToAuthority": true,
      "supervisoryAuthority": "CNIL"
    },
    "euRepresentative": {
      "required": true,
      "name": "EuroRep Legal B.V.",
      "email": "privacy@eurorep.example",
      "phone": null,
      "address": "Herengracht 420, 1017 BZ Amsterdam, Netherlands"
    },
    "ukRepresentative": {
      "required": true,
      "name": "UKRep Ltd",
      "email": "ukdpr@ukrep.example",
      "phone": null,
      "address": "1 Poultry, London EC2R 8EJ, United Kingdom"
    },
    "updatedAt": "2026-08-20T14:12:00.000Z",
    "updatedBy": "user_9d2kd…"
  },
  "completeness": {
    "dpoComplete": true,
    "euRepresentativeComplete": true,
    "ukRepresentativeComplete": true,
    "complete": true,
    "gaps": []
  }
}

Record or update the designation

PUT /compliance/dpo-representative — requires an owner or admin API key. The body may carry any of three top-level sections: dpo, eu_representative, and uk_representative. Each provided section fully replaces the stored section; omitted sections are left intact. At least one section must be provided.

curl -X PUT https://api.orbit.devotel.io/api/v1/compliance/dpo-representative \
  -H "X-API-Key: dv_live_sk_..." \
  -H "Content-Type: application/json" \
  -d '{
    "dpo": {
      "designated": true,
      "name": "Marie Leclerc",
      "email": "dpo@example.com",
      "phone": "+33 1 23 45 67 89",
      "address": "12 rue de la Paix, 75002 Paris, France",
      "is_external": false,
      "notified_to_authority": true,
      "supervisory_authority": "CNIL"
    },
    "eu_representative": {
      "required": true,
      "name": "EuroRep Legal B.V.",
      "email": "privacy@eurorep.example",
      "address": "Herengracht 420, 1017 BZ Amsterdam, Netherlands"
    }
  }'

DPO section fields (dpo):

Field	Type	Notes
`designated`	boolean	Required. Whether a DPO has been designated (Art.37).
`name`	string	The DPO’s name. Mandatory for completeness once designated.
`email`	string	Contact email. Mandatory for completeness once designated.
`phone`	string	Optional contact phone.
`address`	string	Optional postal address.
`is_external`	boolean	Art.37(6) — a DPO fulfilling the tasks under a service contract.
`notified_to_authority`	boolean	Art.37(7) — the designation was communicated to the supervisory authority.
`supervisory_authority`	string	The supervisory authority the designation was communicated to.

Representative section fields (eu_representative / uk_representative):

Field	Type	Notes
`required`	boolean	Required. Whether Art.27 applies for this region (Art.3(2) and not established there).
`name`	string	The representative’s name. Mandatory for completeness once required.
`email`	string	Contact email. Mandatory for completeness once required.
`phone`	string	Optional contact phone.
`address`	string	Art.27 requires the representative be established in the region — mandatory for completeness once required.

The EU and UK representative sections are independent — you can mark one region as required while the other is not. Setting designated: false on the DPO section, or required: false on a representative section, clears the completeness obligation for that section without your having to send contact details.

Export the attestation

GET /compliance/dpo-representative/attestation — available to any authenticated member. Returns the binder-ready attestation: per-designation flags, the completeness assessment, and a statement paragraph you can drop into your compliance binder or consume from a privacy-notice generator (Art.13/Art.14).

curl https://api.orbit.devotel.io/api/v1/compliance/dpo-representative/attestation \
  -H "X-API-Key: dv_live_sk_..."

{
  "generatedAt": "2026-08-24T09:30:00.000Z",
  "dpoDesignated": true,
  "dpoName": "Marie Leclerc",
  "dpoEmail": "dpo@example.com",
  "dpoIsExternal": false,
  "euRepresentativeRequired": true,
  "euRepresentativeDesignated": true,
  "euRepresentativeName": "EuroRep Legal B.V.",
  "ukRepresentativeRequired": true,
  "ukRepresentativeDesignated": true,
  "ukRepresentativeName": "UKRep Ltd",
  "complete": true,
  "gaps": [],
  "statement": "A Data Protection Officer has been designated (GDPR Art.37): Marie Leclerc (dpo@example.com), an internal DPO; the designation has been communicated to the supervisory authority (Art.37(7)). The EU GDPR Art.27 representative has been designated: EuroRep Legal B.V., Herengracht 420, 1017 BZ Amsterdam, Netherlands (privacy@eurorep.example). The UK UK GDPR Art.27 representative has been designated: UKRep Ltd, 1 Poultry, London EC2R 8EJ, United Kingdom (ukdpr@ukrep.example)."
}

When the DPO has not been notified to the authority yet, or a required representative is missing, the statement says so explicitly — the attestation records the actual state, incomplete included, so the binder never overstates your posture.

Completeness gaps — a signal, never a gate

Every GET and PUT response carries a completeness block:

dpoComplete — a designated DPO has at least a name and a contact email.
euRepresentativeComplete / ukRepresentativeComplete — a required representative has a name, a contact email, and an address (Art.27 requires the representative be established in the region).
complete — every applicable designation carries its mandatory contact details.
gaps — a human-readable list naming the mandatory items still missing, for example "Art.37: the designated DPO's contact email is required." or "UK GDPR Art.27: the UK representative's address (established in the region) is required."

The completeness block is a signal to help a compliance owner see, at a glance, whether a designated DPO still lacks its published contact detail or whether a required representative has not yet been named. It never blocks anything — recording the designation is self-serve and default-open, and it never gates outbound sending or any other capability.

Tenant-owned framing

The designation documents your organisation’s DPO and representative choices. Orbit supplies the storage, the section-scoped upsert, the completeness signal, and the binder-ready export — it never decides whether Art.37(1) or Art.3(2) applies to you. Every update is made by your own team and written to your audit log with the actor and the resulting completeness state.

Access control

Reads (GET) are available to any authenticated member of your organisation. Writes (PUT) are restricted to owner and admin roles — the designation is a regulatory control, in line with the rest of the compliance write surface (the processing register, breach incidents, the DPA).

GDPR Processing Register (ROPA + DPIA) — the Art.30/Art.35 register the attestation complements.
Data Processing Agreement — the Art.28 processor terms alongside the designations.
Assembling a GDPR Posture End to End — the full self-documentation sequence.
Data Subject Access Requests (DSAR) — receiving, verifying, and fulfilling subject access, erasure, and portability requests.
Evidence Binder — the binder the attestation statement feeds.
API Reference → Compliance — full request/response schemas (regenerated from the live API).

Getting Started

Channels

AI Agents

Flows

Numbers & Verify

Concepts

Features

Billing

Webhooks

Security & SSO

Compliance

Legal

Changelog

DPO & EU/UK Representative Designation (GDPR Art.37 / Art.27)

The two designations a controller must publish

Endpoints

Get the designation

Record or update the designation

Export the attestation

Completeness gaps — a signal, never a gate

Tenant-owned framing

Access control

​DPO & EU/UK Representative Designation (GDPR Art.37 / Art.27)

​The two designations a controller must publish

​Endpoints

​Get the designation

​Record or update the designation

​Export the attestation

​Completeness gaps — a signal, never a gate

​Tenant-owned framing

​Access control

​Related references

DPO & EU/UK Representative Designation (GDPR Art.37 / Art.27)

The two designations a controller must publish

Endpoints

Get the designation

Record or update the designation

Export the attestation

Completeness gaps — a signal, never a gate

Tenant-owned framing

Access control

Related references