18 March 2025
General Data Protection Regulation (GDPR) vs. General Product Safety Regulation (GPSR): generally, a lot of compliance acronyms
By Jess Pembroke, Director of Information Law Services
In recent years, the landscape of regulatory compliance has evolved significantly, with the introduction of the General Data Protection Regulation (GDPR) and the recent General Product Safety Regulation (GPSR) amongst some of the more notable for those trading in data, digital content and digital products. These regulations aim to enhance consumer protection and safety within the EU, but they also bring a host of compliance challenges for businesses.
Attending the Association For Cultural Enterprises Annual Conference in Liverpool last week, we noted plenty of discussions about the impact the General Product Safety Regulation (GPSR). Those who remember May 2018 as a panicked time of impending “GDPR” compliance may be surprised to hear about this new regulation which hasn’t received as much coverage as the GDPR did. So, what is this regulation and what does it mean for you?
Regulations such as the GDPR and GPSR have direct legal effect across all EU member states without needing to be transposed into national law. This means they effectively become law across all EU member states. Since the UK was part of the EU when the GDPR was implemented, it became law in the UK. However, after leaving the EU, the UK Government transferred it into the UK General Data Protection Regulation (UK GDPR), which is effectively the UK’s own version.
Because the UK is no longer part of the EU, the GPSR does not have direct effect in the UK. This means it is not law in the UK. However, while the GPSR applies to products sold within the EU, the General Product Safety Regulations 2005 continue to govern product safety in the UK which means that if you sell in scope products in the UK and the EU, you need to comply with both.
Apart from sharing “General” and “Regulation” in their name these laws have a lot in common:
| General Product Safety Regulation (GPSR) | EU General Data Protection Regulation (EU GDPR) | |
| Scope | Applies to products sold in the EU, including online, new, used, repaired, or reconditioned. Lists several exemptions. | Applies to organisations processing data of EU citizens. |
| Risk Assessment | Requires rigorous risk assessments throughout the product lifecycle. | Requires consideration of privacy implications throughout a project, especially at the beginning (privacy by design). |
| Clear Language for Consumers | Manufacturers must ensure products are accompanied by clear instructions and safety information in an easily understood language. | Organisations must ensure privacy notices are easily accessible and easy to understand, using clear and plain language. |
| Regulation | National authorities have increased powers to inspect products and take action against unsafe ones. | Supervisory Authorities in the EU have powers to investigate and audit compliance. |
| Consumer Empowerment | Provides consumers with more information and tools to report unsafe products. | Provides data subjects with a broad range of rights. |
| Cybersecurity Measures and AI Features | Incorporates cybersecurity measures and AI-related features to protect products from external threats and enable product evolution, learning, and predictive capabilities. | As part of the principle of “Appropriate security of the personal data” organisations should be conducting due diligence on AI and other technologies to ensure that data is protected from cyber threats. |
Conclusion
Both regulations require robust procurement processes to hold suppliers accountable. Organisations must ensure their suppliers comply with relevant regulations, whether it’s data protection under GDPR, or product safety under GPSR. This involves rigorous vetting, continuous monitoring, and effective management of supply chains to mitigate risks and ensure compliance. Organisations must integrate technical and legal expertise into their project teams to navigate the complexities of these regulations when introducing new products or services.
In summary, the GDPR and GPSR highlight the evolving landscape of consumer protection and safety regulations. Organisations must adapt to these changes by strengthening their procurement processes, managing supply chains effectively, and integrating technical and legal expertise into their operations. By doing so, they can ensure compliance, protect consumers, and build trust in their products and services.
Naomi Korn Associates’ team of professionals can help your organisation ensure that risks and requirements of the law are considered and implemented in a supportive way. To find out more please contact info@naomikorn.com.
Join our course on ‘Information Sharing, Data Processors, and Contracts’ to learn about key considerations when procuring products from suppliers who will process personal data: Information Sharing, Data Processors and Contracts 1 Apr 2025 – 9:30am-1pm Tickets, Tue 1 Apr 2025 at 09:30 | Eventbrite.