> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # DPO & EU/UK Representative Designation (GDPR Art.37 / Art.27) > Record your GDPR Art.37 Data Protection Officer and Art.27 EU/UK representative designations, see completeness gaps, and export a binder-ready attestation for your privacy notice. # DPO & EU/UK Representative Designation (GDPR Art.37 / Art.27) GDPR obliges a controller to publish two designations about itself: a **Data Protection Officer** (Art.37) and, when the controller is not established in the EU or UK but Art.3(2) applies, a **representative** in the Union and/or in the United Kingdom (Art.27 — the UK obligation is the UK GDPR mirror post-Brexit). These designations feed your privacy notice — Art.13/Art.14 require naming the controller, its representative, and its DPO — and the compliance binder. This page describes Orbit's platform controls. It is **not legal advice.** Whether your organisation must designate a DPO (Art.37(1) trigger conditions) or a representative (Art.3(2) applicability) depends on your processing. Confirm with qualified counsel. All endpoints below are rooted at `https://api.orbit.devotel.io/api/v1/compliance`. *** ## The two designations a controller must publish **GDPR Art.37 — Data Protection Officer.** The Art.37(1) trigger conditions are: a public authority, core activities involving large-scale systematic monitoring of data subjects, or large-scale processing of Art.9 special-category / Art.10 criminal-conviction data. When any of them applies the controller must designate a DPO, publish the DPO's contact details, and communicate them to the supervisory authority (Art.37(7)). The DPO may be a staff member or fulfil the tasks under a service contract (Art.37(6) — an external DPO). **GDPR Art.27 — EU/UK representative.** A controller not established in the Union that nonetheless falls under Art.3(2) (offering goods or services to, or monitoring, data subjects in the Union) must designate in writing a representative established in a Member State where those data subjects are. UK GDPR Art.27 imposes the mirror obligation for a UK representative post-Brexit. Orbit tracks the EU and UK representative designations independently — record each region separately. Also see [GDPR Posture Guide](/compliance/gdpr-posture-guide) for the wider self-documentation sequence. *** ## Endpoints ### Get the designation `GET /compliance/dpo-representative` — available to any authenticated member of your organisation. Returns the designation plus a `completeness` block. ```bash theme={null} curl https://api.orbit.devotel.io/api/v1/compliance/dpo-representative \ -H "X-API-Key: dv_live_sk_..." ``` ```json theme={null} { "designation": { "dpo": { "designated": true, "name": "Marie Leclerc", "email": "dpo@example.com", "phone": "+33 1 23 45 67 89", "address": "12 rue de la Paix, 75002 Paris, France", "isExternal": false, "notifiedToAuthority": true, "supervisoryAuthority": "CNIL" }, "euRepresentative": { "required": true, "name": "EuroRep Legal B.V.", "email": "privacy@eurorep.example", "phone": null, "address": "Herengracht 420, 1017 BZ Amsterdam, Netherlands" }, "ukRepresentative": { "required": true, "name": "UKRep Ltd", "email": "ukdpr@ukrep.example", "phone": null, "address": "1 Poultry, London EC2R 8EJ, United Kingdom" }, "updatedAt": "2026-08-20T14:12:00.000Z", "updatedBy": "user_9d2kd…" }, "completeness": { "dpoComplete": true, "euRepresentativeComplete": true, "ukRepresentativeComplete": true, "complete": true, "gaps": [] } } ``` ### Record or update the designation `PUT /compliance/dpo-representative` — requires an **owner** or **admin** API key. The body may carry any of three top-level sections: `dpo`, `eu_representative`, and `uk_representative`. Each provided section fully replaces the stored section; omitted sections are left intact. At least one section must be provided. ```bash theme={null} curl -X PUT https://api.orbit.devotel.io/api/v1/compliance/dpo-representative \ -H "X-API-Key: dv_live_sk_..." \ -H "Content-Type: application/json" \ -d '{ "dpo": { "designated": true, "name": "Marie Leclerc", "email": "dpo@example.com", "phone": "+33 1 23 45 67 89", "address": "12 rue de la Paix, 75002 Paris, France", "is_external": false, "notified_to_authority": true, "supervisory_authority": "CNIL" }, "eu_representative": { "required": true, "name": "EuroRep Legal B.V.", "email": "privacy@eurorep.example", "address": "Herengracht 420, 1017 BZ Amsterdam, Netherlands" } }' ``` **DPO section fields** (`dpo`): | Field | Type | Notes | | ----------------------- | ------- | -------------------------------------------------------------------------- | | `designated` | boolean | **Required.** Whether a DPO has been designated (Art.37). | | `name` | string | The DPO's name. Mandatory for completeness once designated. | | `email` | string | Contact email. Mandatory for completeness once designated. | | `phone` | string | Optional contact phone. | | `address` | string | Optional postal address. | | `is_external` | boolean | Art.37(6) — a DPO fulfilling the tasks under a service contract. | | `notified_to_authority` | boolean | Art.37(7) — the designation was communicated to the supervisory authority. | | `supervisory_authority` | string | The supervisory authority the designation was communicated to. | **Representative section fields** (`eu_representative` / `uk_representative`): | Field | Type | Notes | | ---------- | ------- | ----------------------------------------------------------------------------------------------------------- | | `required` | boolean | **Required.** Whether Art.27 applies for this region (Art.3(2) and not established there). | | `name` | string | The representative's name. Mandatory for completeness once required. | | `email` | string | Contact email. Mandatory for completeness once required. | | `phone` | string | Optional contact phone. | | `address` | string | Art.27 requires the representative be established in the region — mandatory for completeness once required. | The EU and UK representative sections are independent — you can mark one region as required while the other is not. Setting `designated: false` on the DPO section, or `required: false` on a representative section, clears the completeness obligation for that section without your having to send contact details. ### Export the attestation `GET /compliance/dpo-representative/attestation` — available to any authenticated member. Returns the binder-ready attestation: per-designation flags, the completeness assessment, and a `statement` paragraph you can drop into your compliance binder or consume from a privacy-notice generator (Art.13/Art.14). ```bash theme={null} curl https://api.orbit.devotel.io/api/v1/compliance/dpo-representative/attestation \ -H "X-API-Key: dv_live_sk_..." ``` ```json theme={null} { "generatedAt": "2026-08-24T09:30:00.000Z", "dpoDesignated": true, "dpoName": "Marie Leclerc", "dpoEmail": "dpo@example.com", "dpoIsExternal": false, "euRepresentativeRequired": true, "euRepresentativeDesignated": true, "euRepresentativeName": "EuroRep Legal B.V.", "ukRepresentativeRequired": true, "ukRepresentativeDesignated": true, "ukRepresentativeName": "UKRep Ltd", "complete": true, "gaps": [], "statement": "A Data Protection Officer has been designated (GDPR Art.37): Marie Leclerc (dpo@example.com), an internal DPO; the designation has been communicated to the supervisory authority (Art.37(7)). The EU GDPR Art.27 representative has been designated: EuroRep Legal B.V., Herengracht 420, 1017 BZ Amsterdam, Netherlands (privacy@eurorep.example). The UK UK GDPR Art.27 representative has been designated: UKRep Ltd, 1 Poultry, London EC2R 8EJ, United Kingdom (ukdpr@ukrep.example)." } ``` When the DPO has not been notified to the authority yet, or a required representative is missing, the statement says so explicitly — the attestation records the actual state, incomplete included, so the binder never overstates your posture. *** ## Completeness gaps — a signal, never a gate Every `GET` and `PUT` response carries a `completeness` block: * `dpoComplete` — a designated DPO has at least a name and a contact email. * `euRepresentativeComplete` / `ukRepresentativeComplete` — a required representative has a name, a contact email, and an address (Art.27 requires the representative be established in the region). * `complete` — every applicable designation carries its mandatory contact details. * `gaps` — a human-readable list naming the mandatory items still missing, for example `"Art.37: the designated DPO's contact email is required."` or `"UK GDPR Art.27: the UK representative's address (established in the region) is required."` The completeness block is a signal to help a compliance owner see, at a glance, whether a designated DPO still lacks its published contact detail or whether a required representative has not yet been named. It never blocks anything — recording the designation is self-serve and default-open, and it never gates outbound sending or any other capability. *** ## Tenant-owned framing The designation documents **your** organisation's DPO and representative choices. Orbit supplies the storage, the section-scoped upsert, the completeness signal, and the binder-ready export — it never decides whether Art.37(1) or Art.3(2) applies to you. Every update is made by your own team and written to your audit log with the actor and the resulting completeness state. *** ## Access control Reads (`GET`) are available to any authenticated member of your organisation. Writes (`PUT`) are restricted to **owner** and **admin** roles — the designation is a regulatory control, in line with the rest of the compliance write surface (the processing register, breach incidents, the DPA). *** ## Related references * [GDPR Processing Register (ROPA + DPIA)](/compliance/privacy-register) — the Art.30/Art.35 register the attestation complements. * [Data Processing Agreement](/compliance/data-processing-agreement) — the Art.28 processor terms alongside the designations. * [Assembling a GDPR Posture End to End](/compliance/gdpr-posture-guide) — the full self-documentation sequence. * [Data Subject Access Requests (DSAR)](/compliance/dsar) — receiving, verifying, and fulfilling subject access, erasure, and portability requests. * [Evidence Binder](/compliance/evidence-binder) — the binder the attestation statement feeds. * [API Reference → Compliance](/api-reference/endpoints/compliance) — full request/response schemas (regenerated from the live API).