Do personal data rules apply to an importer?
Short answer
Yes for the records the importer holds itself, such as customer, warranty and service records.
Read against the registers 2026-08-26.
Who the role is
Whoever places a product from outside the union on the union market steps into the manufacturer's line of duties.
What the topic covers
The three main personal data regimes cover the same records but start from different premises. The GDPR asks for a legal basis before processing. California gives the consumer rights after the fact. PIPL asks for separate consent for named categories.
The rows behind the answer
European Union
- GDPR — Regulation (EU) 2016/679: Requires a legal basis per purpose, information to the person, and rights of access, correction and erasure.
- ePrivacy Directive — Directive 2002/58/EC: Covers terminal equipment: cookies and similar reading of a device need consent unless strictly necessary.
United States
- California Consumer Privacy Act, as amended by the CPRA: Applies above stated thresholds. Consumers can know, delete, correct and opt out of sale or sharing.
- FTC Act Section 5, unfair or deceptive practices in AI and data: Data claims in a privacy notice are enforceable as representations under Section 5.
China
- Personal Information Protection Law of the People's Republic of China: Requires a lawful ground, separate consent for sensitive categories and a named person responsible.
Where companies usually start
- List the purposes first, then the data each purpose needs, and not the other way round.
- Check which of the three regimes the same record falls under at the same time.
- Keep one written record of purposes that all three notices are generated from.
This page reads published registers and describes common practice. It is not legal advice and it is not a compliance verdict.
Other questions for importer
- Do ai governance rules apply to an importer?
- Do cross-border data rules apply to an importer?
- Do cybersecurity rules apply to an importer?
- Do health data rules apply to an importer?
- Do online platforms rules apply to an importer?
- Do consumer rights rules apply to an importer?
- Do product safety rules apply to an importer?
- Do climate disclosure rules apply to an importer?
- Do export controls rules apply to an importer?
ExploreWorldAI is operated by Valkiv Ventures AB (Reg. no. 556995-1311), Kungsgatan 8, 111 43 Stockholm, Sweden. EU-hosted, with data processing assessed against the GDPR. Contact: hello@exploreworldai.com.
Machine-readable summaries for AI agents: /llms.txt and /llms-full.txt.
