Home › Compare laws side by side › UK PSTI (connected products) vs EU GDPR

UK PSTI (connected products) vs EU GDPR

Product Security and Telecommunications Infrastructure Act 2022 (Part 1) and the 2023 Security Requirements Regulations (United Kingdom) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	UK PSTI (connected products) United Kingdom 13/14 facts confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	In force. Act Part 1 framework from 6 Dec 2022; security requirements and statement-of-compliance rules apply since 29 Apr 2024 (SI 2023/1007). Amended by SI 2025/211 (25 Feb 2025) and SI 2025/1267 (4 Dec 2025).✓	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	Manufacturers, importers and distributors of 'UK consumer connectable products': internet- or network-connectable products offered to UK consumers (e.g. smart TVs, cameras, speakers, toys, wearables, routers). Excluded: desktops, laptops and non-cellular tablets (unless designed only for under-14s); medical devices; smart meters; EV smart charge points; certain products for Northern Ireland under the Windsor Framework; and, in Great Britain from 25 Feb 2025, motor vehicles, two/three-wheelers and quadricycles, and agricultural/forestry vehicles.✓	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	None by company size or revenue. Scope turns on the product: new products offered to UK consumers, plus business-only products identical to consumer ones. Products already supplied to a customer (e.g. second-hand) are generally outside scope.✓	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	Office for Product Safety and Standards (OPSS), enforcing on behalf of the Secretary of State, who is the statutory enforcement authority.✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	On learning of a possible compliance failure, take all reasonable steps to investigate. If a failure is confirmed: manufacturers must stop supply and remedy it as soon as practicable and notify the enforcement authority, other manufacturers and the importers/distributors they supplied; importers and distributors must contact the manufacturer, stop supply if it is unlikely to be fixed, and notify the enforcement authority and those they supplied. Keep records of investigations and failures for 10 years.✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	N/A✓	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	N/A✓	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	No duty to appoint a UK representative. A UK business importing a product from outside the UK takes on importer duties. A manufacturer may use an authorised representative, who must contact the manufacturer and then notify the enforcement authority of a compliance failure.	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	N/A✓	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	N/A✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Up to £10 million or 4% of qualifying worldwide revenue, whichever is greater, plus up to £20,000 per day for a continuing breach. OPSS can also issue compliance, stop and recall notices and seek forfeiture.✓	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

UK PSTI (connected products): Manufacturers, importers and distributors of 'UK consumer connectable products': internet- or network-connectable products offered to UK consumers (e.g. smart TVs, cameras, speakers, toys, wearables, routers). Excluded: desktops, laptops and non-cellular tablets (unless designed only for under-14s); medical devices; smart meters; EV smart charge points; certain products for Northern Ireland under the Windsor Framework; and, in Great Britain from 25 Feb 2025, motor vehicles, two/three-wheelers and quadricycles, and agricultural/forestry vehicles.
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under UK PSTI (connected products)

Ship no universal default or easily guessable passwords: make them unique per product or user-set.
Publish a contact point for reporting security issues, with acknowledgement and update timelines.
Publish the minimum security-update (support) period; never shorten it once published.
Supply each product with a statement of compliance (or summary) and keep a copy for 10 years or the support period, if longer.
Do not supply products you know or believe fail the requirements.
Investigate suspected failures, fix them, and notify OPSS and affected supply-chain parties.

Full UK PSTI (connected products) page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.