GDPR for IoT — Compliance Guide for Connected Product Companies
GDPR compliance guide for IoT manufacturers and connected product companies. Smart devices, telemetry data, product lifecycle, and EU Representative.
The Internet of Things (IoT) creates one of the most complex GDPR compliance scenarios. Smart devices collect, transmit, and often retain personal data throughout the product lifecycle. For non-EU manufacturers of IoT products sold in the EU, Article 27 requires an EU Representative — and the risks of non-compliance are amplified by the continuous nature of IoT data processing.
IoT Data Types Under GDPR
- Device identifiers: Serial numbers, MAC addresses, device IDs — if linked to an identifiable individual, they are personal data
- Telemetry/usage data: Operating status, feature usage, error logs, performance data — behavioral personal data
- Location data: GPS coordinates from connected vehicles, wearables, tracking devices — personal data with special protections
- Environmental data: Temperature, motion, humidity readings from smart home sensors — if linked to a home, may constitute personal data
- Audio/video data: Smart speakers, smart displays, doorbell cameras — voice recordings and video footage are clearly personal data
- Biometric data: Smart watches measuring heart rate, sleep patterns, step counts — health data under Article 9
Product Lifecycle Data Processing
IoT products process data across multiple lifecycle phases: manufacturing (firmware, test data), installation (setup, network config), daily use (telemetry, features), firmware updates (patch management, update verification), support (diagnostics, troubleshooting), end-of-life (device decommissioning, data deletion). Each phase requires ROPA documentation. Template →
The Data Act + GDPR Intersection
The EU Data Act (effective 2024-2025) adds requirements for IoT product data sharing and portability. For non-EU manufacturers: your product data that constitutes personal data must comply with both GDPR (data subject rights) and the Data Act (data sharing obligations).
Smart Home vs Industrial IoT
Smart home (B2C): Full GDPR obligations — consumer devices processing EU resident data. EU Representative required.
Industrial IoT (B2B): Still processes personal data (machine operators, maintenance staff, facility managers). EU Representative required for contact data. Guide →
Compliance Steps
- Appoint EU Shield as EU Representative
- Map data flows across product lifecycle
- Conduct DPIA for high-risk features (location, biometrics)
- Implement privacy-by-design in firmware (minimal telemetry, local processing where possible)
- Update Privacy Policy with product-specific processing details
- Create end-of-life data deletion protocol for returned/decommissioned devices
Ready to get compliant?
€490/year. 15-minute setup. Active next business day.