Amendment 1171· GDPR Article 24(4)
+Addition
Text of the amendment
As tabled
Amending instruction
7b. In Article 24, paragraph 4 is added:
Wording it would add
The manufacturer shall design and develop its products, services and applications, taking into account the right to the protection of personal data and the state of the art, in such a manner that controllers and processors using those products, services and applications for the processing of personal data are able to comply with their obligations under this Regulation based on the default settings and without having to make disproportionate modifications to those products, services and applications. The manufacturer shall support controllers and processors in fulfilling their obligations under Articles 30, 33 and 34 by providing, upon request, all information necessary for that purpose. This paragraph does not apply to free and open-source software that is developed or supplied outside the course of a commercial activity.‘
GDPR Article 24 with this amendment
Amendment 1171 applied to the Commission proposal, no other amendment
Unchanged: (1), (2) and (3)
Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.
Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.
Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.
The manufacturer shall design and develop its products, services and applications, taking into account the right to the protection of personal data and the state of the art, in such a manner that controllers and processors using those products, services and applications for the processing of personal data are able to comply with their obligations under this Regulation based on the default settings and without having to make disproportionate modifications to those products, services and applications. The manufacturer shall support controllers and processors in fulfilling their obligations under Articles 30, 33 and 34 by providing, upon request, all information necessary for that purpose. This paragraph does not apply to free and open-source software that is developed or supplied outside the course of a commercial activity.‘
+NewJustification
Exception for non-commercial free and open-source software from Article 2(2) of the Product Liability Directive (EU) 2024/2853.
Target
Wording of the targeted provisionlaw in force, Commission proposal, latest Council text
No Council text amends Article 24(4).
Cite this amendment
Amendment 1171 (Markéta Gregorová), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1053–1260 to the draft report on COM(2025) 837 (CJ72-AM-791073, PE791.073v01-00, 27 July 2026), p. 103
Link, short form and official text
Amendment 1171 (Markéta Gregorová), European Parliament, Committee on Industry, Research and Energy and Committee on Civil Liberties, Justice and Home Affairs, amendments 1053–1260 to the draft report on COM(2025) 837 (CJ72-AM-791073, PE791.073v01-00, 27 July 2026), p. 103
ITRE–LIBE Amendment 1171 (CJ72-AM-791073), p. 103