The GDPR (the General Data Protection Regulation) applied before a single word was written about a digital product passport or an AI Regulation, and that regulation does not disappear because new rules are added. Whenever your business processes personal data — and almost every business does, through personnel files, customer data, or equipment that records usage data — the GDPR continues to apply alongside the new regulations.
Whether the GDPR affects your business in a specific situation depends on the question of whether personal data is actually being processed. A digital product passport containing only technical data about a device (materials, repair instructions, warranty period) generally falls outside the scope of the GDPR. Once data is added that can be traced back to a person — a serial number linked to an owner, usage data from an employee, or a chatbot that processes customer inquiries — the situation shifts into GDPR territory.
Why this topic comes up more often than you might think
The Ecodesign Regulation (ESPR), the digital product passport, and the AI Regulation are all three new, and it is tempting to think that they replace or make the GDPR unnecessary. That is not the case. These regulations govern other matters: product information, environmental requirements, and the handling of AI systems. The GDPR governs something else, namely the protection of personal data, regardless of which system or device records that data. The four frameworks can therefore apply simultaneously to the same situation, without one replacing the other.
An example makes this concrete. An installation company that installs smart meters may find itself dealing with the digital product passport for the device itself, and at the same time with the GDPR once that meter records consumption data from a specific household. Both regulations then apply side by side, for the same device, but for a different aspect of it.
When the GDPR does come into play
The GDPR comes into play once data can be traced back to an identified or identifiable person. This can involve personnel data when implementing a new AI system on the work floor, customer data that a supplier processes on your behalf, or usage data that a device collects and forwards to a manufacturer. The GDPR supervisor in the Netherlands is the Dutch Data Protection Authority; it does not assess the digital product passport or the AI Regulation itself, but it does assess how personal data that plays a role in them is handled.
For anyone determining whether personal data is being processed in a specific project, it is useful to look at that per data stream: what is recorded, by whom, and can it be traced back to a person. That distinction determines whether the GDPR applies, regardless of whether a digital product passport or an AI system is also involved. how we handle personal data in the product passport gives an overview of how that distinction plays out in practice.
When the GDPR plays no additional role
Not every technical data stream falls under the GDPR. Material composition, warranty periods, repair instructions, and comparable product information are generally not traceable to a person, and therefore fall outside the scope of the GDPR. That does not mean that no rules apply — the digital product passport and the ESPR set their own requirements for that information — but it does mean that the GDPR imposes no additional obligation in that specific stream.
This distinction is also relevant when deploying AI in the workplace. An AI system that only analyses machine data usually does not fall under the GDPR. As soon as the same system assesses the behaviour or performance of individual employees, that picture changes, and the GDPR comes into play alongside the AI Act. Anyone who wants to clarify that distinction for their own situation should best put it to a lawyer or the Authority for Personal Data; a general article can sketch that distinction, but cannot determine it for one specific situation.
How you verify this for your own business
Because the GDPR, the ESPR, the digital product passport and the AI Act each have their own scope of application, it is worthwhile to check separately for each obligation whether it applies to your business, rather than treating them as one whole. In the knowledge base sorted by subject that distinction is worked out per regulation, so you do not have to understand everything at once.
Would you like a quick first indication of whether your situation has touchpoints with the digital product passport or the AI Act, and thus possibly also with the GDPR? Then do the free quick-scan get a first indication in a few questions, or view the answers to questions other entrepreneurs have already asked. For your own specific situation, a lawyer or the Authority for Personal Data remains the right point of contact.