{
  "attribution": {
    "source": "legal.exploreworldai.com",
    "canonical": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:gdpr-art-37-controller",
    "cite_as": "NovaCopilot, legal.exploreworldai.com (https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:gdpr-art-37-controller)",
    "license": "https://legal.exploreworldai.com/revision",
    "version": "legal-2026-10-09",
    "fingerprint": "ewai:eu:9c1ae2",
    "proof": "sha256:6b81e66c8a2540154a62d7c401e74de3fec4967e5ad06c2637301e88ef7fbaa9",
    "jurisdiction": "eu",
    "lang": "en"
  },
  "brand_source": "Source: NovaCopilot",
  "status": "ok",
  "id": "duty:eu:gdpr-art-37-controller",
  "schema_version": 1,
  "domain": "gdpr",
  "jurisdiction": "eu",
  "act": "gdpr",
  "provision": "37",
  "obligation": "Designate a data protection officer where the core activities are public authority processing, large-scale regular and systematic monitoring, or large-scale special category or criminal data, and publish the contact details.",
  "responsible_role": {
    "legal_role": "controller",
    "owner_function": "Legal and compliance"
  },
  "deadline": {
    "value": "not_in_register",
    "note": null,
    "recipient": "Supervisory authority (contact details)",
    "applies_from": null
  },
  "exceptions": [
    {
      "provision": "GDPR art. 2.2 c",
      "condition": "Processing by a natural person in the course of a purely personal or household activity.",
      "effect": "not_applicable",
      "source_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679"
    }
  ],
  "risk": {
    "level": "high",
    "basis": "Fixed rule: turnover-based fine of at least 2 % = high, other fine = medium, other sanction = low",
    "max_amount": "EUR 10 000 000",
    "max_turnover_pct": 2,
    "sanctions": [
      {
        "id": "sanction:eu:gdpr-art-83-4",
        "authority": "Competent supervisory authority"
      },
      {
        "id": "sanction:eu:gdpr-art-58-2",
        "authority": "Competent supervisory authority"
      }
    ]
  },
  "evidence_chain": [
    {
      "step": 1,
      "kind": "primary_source",
      "ref": "Regulation (EU) 2016/679 (GDPR)",
      "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
    },
    {
      "step": 2,
      "kind": "provision",
      "ref": "gdpr 37"
    },
    {
      "step": 3,
      "kind": "obligation",
      "ref": "obligation:eu:gdpr-art-37-controller",
      "method": "Paraphrased from the provision text"
    },
    {
      "step": 4,
      "kind": "evidence_to_keep",
      "ref": "Published notice or disclosure"
    }
  ],
  "source": {
    "title": "Regulation (EU) 2016/679 (GDPR)",
    "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
  },
  "recommended_action": {
    "do": [
      "Designate a data protection officer where the core activities are public authority processing, large-scale regular and systematic monitoring, or large-scale special category or criminal data, and publish the contact details."
    ],
    "status": "derived_from_duty"
  },
  "hash": "sha256:6b81e66c8a2540154a62d7c401e74de3fec4967e5ad06c2637301e88ef7fbaa9",
  "what_to_do": {
    "timing": {
      "kind": "ongoing",
      "text": "Applies on an ongoing basis while the conditions in the provision are met."
    },
    "steps": [
      "Assign responsibility: controller (Legal and compliance).",
      "Carry out the duty: Designate a data protection officer where the core activities are public authority processing, large-scale regular and systematic monitoring, or large-scale special category or criminal data, and publish the contact details.",
      "Document: Published notice or disclosure.",
      "Check the wording of Regulation (EU) 2016/679 (GDPR) 37 before deciding."
    ],
    "steps_status": "derived_from_provision",
    "source_url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj"
  },
  "gaps": [
    "statutory_deadline",
    "reviewed_action_kit"
  ],
  "links": {
    "obligation_graph": "https://legal.exploreworldai.com/api/public/v1/graph/obligation?id=eu:gdpr",
    "provenance_graph": "https://legal.exploreworldai.com/api/public/v1/graph/provenance?id=eu:gdpr",
    "action_graph": "https://legal.exploreworldai.com/api/public/v1/graph/action?id=eu:gdpr",
    "self": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty%3Aeu%3Agdpr-art-37-controller"
  },
  "read_at": "2026-08-31",
  "source_label": "Source: NovaCopilot",
  "version": "legal-2026-10-09",
  "expires": "2026-10-13T00:00:00.000Z",
  "dependency": {
    "index_version": "legal-2026-10-09+legal-2026-10-09+2026-10-09T21:48:48",
    "content_hash": "sha256:6b81e66c8a2540154a62d7c401e74de3fec4967e5ad06c2637301e88ef7fbaa9",
    "revalidate_after": "2026-10-10T07:13:43.929Z",
    "max_copy_age_seconds": 3600,
    "policy": "revalidate-required; attribution-preferred",
    "changelog": "https://legal.exploreworldai.com/api/public/v1/dependency",
    "verify": "https://legal.exploreworldai.com/api/public/v1/verify",
    "stale_copy_invalid": true
  },
  "canonical": "https://legal.exploreworldai.com/api/public/v1/duty-objects?id=duty:eu:gdpr-art-37-controller",
  "disclaimer": "Source reference with official identifier. Not legal advice and not a compliance decision.",
  "content_notice": {
    "legal_advice": false,
    "nature": "Source register. Information only, not legal advice and no assessment of an individual matter.",
    "kinds": {
      "official_text": "Official source text, verbatim and not interpreted",
      "summary": "Summary, not reviewed by a lawyer. Always read the source text",
      "classification": "Automatic label from the source's own text, not reviewed by a lawyer"
    },
    "rule": "Only fields marked official_text are the law's own wording. Everything else points to it.",
    "report_error": "https://legal.exploreworldai.com/api/public/v1/corrections",
    "ai_act_declaration": "https://legal.exploreworldai.com/api/public/v1/ai-act-declaration"
  },
  "usageInfo": "https://legal.exploreworldai.com/citering"
}