Comparison
CRA vs GDPR: which one applies to your product?
Short answer: they regulate different things, and both can apply to the same company at the same time. The Cyber Resilience Act (CRA) governs the cybersecurity of the product itself; the GDPR governs how you process personal data. Being in scope of one tells you nothing about the other.
What each one regulates
The CRA applies to a product with digital elements: a software or hardware product and its remote data processing solutions, made available on the market where its intended or reasonably foreseeable use includes a data connection to a device or network. Its duties, such as vulnerability handling, secure defaults, a software bill of materials and a declared support period, attach to the product and to the manufacturer, importer or distributor who supplies it, not to whatever personal data the product happens to process.
“a software or hardware product and its remote data processing solutions, including software or hardware components being placed on the market separately”
“This Regulation applies to products with digital elements made available on the market, the intended purpose or reasonably foreseeable use of which includes a direct or indirect logical or physical data connection to a device or network.”
The General Data Protection Regulation, Regulation (EU) 2016/679, regulates something different: how any organisation collects, stores, shares and otherwise processes the personal data of people in the EU, whether that processing happens through a product with digital elements, a spreadsheet, or a phone call. It sets principles such as having a lawful basis for processing, collecting no more data than needed, and keeping data secure, and it gives national data protection authorities the power to investigate and to fine. Full text: Regulation (EU) 2016/679, OJ L 119, 4.5.2016 (GDPR).
Do they overlap, and which takes precedence?
The CRA names other Union acts whose product rules take precedence over it for specific product categories (Art. 2(2) to (4)): medical devices, in vitro diagnostic medical devices, road vehicle type-approval, certified civil aviation products and marine equipment.
“This Regulation does not apply to products with digital elements to which the following Union legal acts apply:”
The GDPR is not on that list, and nothing in the Regulation subordinates data-protection law to the CRA, or the reverse. Practically: if your product is in scope of the CRA and it also processes personal data, both regimes apply in full, at the same time, to the same product. Cybiq’s own compliance engine does not ask about the GDPR when scoping a product, because the GDPR is not a scope carve-out: it neither excludes a product from the CRA nor is excluded by it.
The CRA’s own security duty sits alongside, not instead of, the GDPR’s: manufacturers must ensure vulnerabilities are handled effectively and in accordance with the essential cybersecurity requirements, which is a product-safety test, not a data-protection one.
“vulnerabilities of a product with digital elements are handled effectively and in accordance with the essential cybersecurity requirements”
The two regimes even set different penalty ceilings: Art. 64(2) of the CRA sets fines of up to EUR 15 000 000 or, for an undertaking, up to 2.5 % of total worldwide annual turnover, whichever is higher, for breaches of Annex I and of Articles 13 and 14.
“administrative fines of up to EUR 15 000 000 or, if the offender is an undertaking, up to 2,5 % of the its total worldwide annual turnover for the preceding financial year, whichever is higher.”
What this means in practice
- If your product collects any personal data (accounts, telemetry, health readings from a wearable), you need a GDPR lawful basis and privacy notice for that processing, on top of and separate from your CRA duties.
- The CRA’s vulnerability-handling duty and the GDPR’s security-of-processing duty ask a related question, is this secure, through two different legal tests enforced by two different regulators; satisfying one is not evidence you satisfy the other.
- A personal-data breach can trigger GDPR notification duties to a data protection authority, and sometimes to the people affected, on a timeline independent of anything the CRA’s Article 14 reporting requires.
- Under Art. 83(5) GDPR, fines can reach EUR 20 000 000 or, for an undertaking, 4 % of total worldwide annual turnover, whichever is higher; the CRA ceilings above are separate and enforced separately.
- Two different regulators police these: your market surveillance authority for the CRA, your national data protection authority for the GDPR. Clearance from one says nothing about the other.
Cybiq checks the CRA only: it does not assess your product’s compliance with the GDPR or any other regime. Orientation, not legal advice. Quoted spans come from Regulation (EU) 2024/2847 as published in the Official Journal and are re-verified against the live text by automated tests. Verify before relying on any item; for a binding assessment consult a qualified lawyer.