Skip to main content

App User Data Privacy & Security: CRA and GDPR Interplay

For app developers, protecting user data is paramount. The EU Cyber Resilience Act (CRA) and the General Data Protection Regulation (GDPR) both play crucial roles, but they tackle data protection from different angles.

CRA: Security of the App Itself​

The CRA focuses on making your app (the "product with digital elements") secure by design and throughout its lifecycle. Several essential cybersecurity requirements directly impact data security:

  • Confidentiality of Data: Your app must protect personal and other data it processes, using measures like encryption for data at rest and in transit (Annex I, Part I, Point 2e).
  • Integrity of Data: Ensure data is safe from unauthorized alteration (Annex I, Part I, Point 2f).
  • Data Minimisation (Product Security View): The app should process only data necessary for its function, limiting potential exposure (Annex I, Part I, Point 2g).
  • Protection from Unauthorised Access: Implement robust controls like authentication and access management (Annex I, Part I, Point 2d).
  • Secure Data Removal: Allow users to securely and permanently remove their data and settings (Annex I, Part I, Point 2m).

GDPR: Rights and Lawful Processing​

GDPR (Regulation (EU) 2016/679) centers on the fundamental rights of individuals regarding their personal data. It governs:

  • Lawful basis for processing data (e.g., consent, contract).
  • Transparency (informing users how their data is used).
  • Data subject rights (access, correction, deletion).
  • Obligations for data controllers and processors.
  • Data breach notifications to authorities and individuals.

How They Work Together​

The CRA and GDPR are allies.

  • Technical Measures for GDPR: The CRA's requirements for secure app development and vulnerability handling provide a strong foundation for the "technical and organisational measures" mandated by GDPR Article 32 (Security of processing).
  • Data Protection by Design & Default (GDPR Article 25): The CRA's emphasis on "secure by default configuration" (Annex I, Part I, Point 2b) and risk-based security directly supports this GDPR principle.

Complying with the CRA's security mandates makes it easier to meet GDPR's security obligations. However, CRA compliance alone is not full GDPR compliance. You still need to address all GDPR requirements regarding lawful processing, consent, user rights, etc.

Key Takeway​

The CRA mandates specific security measures for your app that protect user data, reinforcing GDPR's technical security requirements. While CRA helps with "security of processing" under GDPR, app developers must still independently ensure full compliance with all other GDPR obligations related to personal data.