CRA FAQ - Remote Data Processing Solutions

What is remote data processing?

Remote data processing is defined in Article 3(2) of the CRA. It extends the scope of the CRA to any remote backend software and hardware that supports a product's user-facing features (such as login, data storage, third party AI models, etc.).

Disclaimer

Disclaimer: The information contained in this FAQ is of a general nature only and is not intended to address the specific circumstances of any particular individual or entity. It is not necessarily comprehensive, complete, accurate, or up to date. It does not constitute professional or legal advice. If you need specific advice, you should consult a suitably qualified professional.

Edit on GitHub Go to page

What is considered remote data processing?

Any user-facing feature of a product that relies on processing data at a distance (regardless of how the connection is established) is considered remote data processing. This is true even if the feature is also available directly on the product.

Disclaimer

Disclaimer: The information contained in this FAQ is of a general nature only and is not intended to address the specific circumstances of any particular individual or entity. It is not necessarily comprehensive, complete, accurate, or up to date. It does not constitute professional or legal advice. If you need specific advice, you should consult a suitably qualified professional.

Edit on GitHub Go to page

What is not considered remote data processing?

The following are not considered remote data processing:

Remote processing of data that isn't fed back into the product (such as telemetry data).
Websites that do not support the function of the product (by contrast with websites that support a function, such as providing an authentication page).
Data processing that supports the manufacturer’s own operations (such as payroll systems, customer relationship management, or other administrative systems).

Note

Note that you might still be subject to other EU regulation even if you fall out of scope of the remote data processing requirements of the CRA.

Disclaimer

Disclaimer: The information contained in this FAQ is of a general nature only and is not intended to address the specific circumstances of any particular individual or entity. It is not necessarily comprehensive, complete, accurate, or up to date. It does not constitute professional or legal advice. If you need specific advice, you should consult a suitably qualified professional.

Edit on GitHub Go to page

Are 3rd-party remote data processing solutions in scope?

Yes. Third party remote data processing solutions are in scope of the CRA. They are subject to the due diligence requirements defined in Article 13(5).

Disclaimer

Disclaimer: The information contained in this FAQ is of a general nature only and is not intended to address the specific circumstances of any particular individual or entity. It is not necessarily comprehensive, complete, accurate, or up to date. It does not constitute professional or legal advice. If you need specific advice, you should consult a suitably qualified professional.

Edit on GitHub Go to page

Are remote data processing solutions that are built in house subject to the CRA?

Yes. Remote data processing solutions that are built in-house are subject to the CRA just as if they were a product. They are therefore subject to all of the essential requirements of Annex I.

Disclaimer

Disclaimer: The information contained in this FAQ is of a general nature only and is not intended to address the specific circumstances of any particular individual or entity. It is not necessarily comprehensive, complete, accurate, or up to date. It does not constitute professional or legal advice. If you need specific advice, you should consult a suitably qualified professional.

Edit on GitHub Go to page

Is cloud infrastructure that supports remote data processing also in scope?

Absolutely! Any third-party infrastructure that supports remote data processing is in scope of the CRA and is subject to the due diligence requirements of Article 13(5).

Disclaimer

Disclaimer: The information contained in this FAQ is of a general nature only and is not intended to address the specific circumstances of any particular individual or entity. It is not necessarily comprehensive, complete, accurate, or up to date. It does not constitute professional or legal advice. If you need specific advice, you should consult a suitably qualified professional.

Edit on GitHub Go to page

🌐 Remote Data Processing Solutions