EN 1090 vs GDPR UK
EN 1090
European standard for steel/aluminium structural execution and CE marking
GDPR UK
UK regulation for personal data protection and privacy
Quick Verdict
EN 1090 governs structural steel fabrication for CE marking in construction, while GDPR UK mandates personal data protection across all sectors. Fabricators certify FPC for market access; all firms adopt GDPR UK to avoid massive fines and ensure compliance.
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Enables CE marking via Factory Production Control certification
- Risk-scaled Execution Classes (EXC1-EXC4) for proportionality
- Detailed technical rules for steel (EN 1090-2) and aluminium (EN 1090-3)
- Welding quality management aligned with ISO 3834
- Material traceability and inspection regimes by risk level
GDPR UK
UK General Data Protection Regulation (UK GDPR)
Key Features
- Seven core data processing principles with accountability
- Enforceable individual data subject rights
- 72-hour personal data breach notification to ICO
- Mandatory DPIAs for high-risk processing
- Risk-based security and international transfer safeguards
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
EN 1090 Details
What It Is
EN 1090 is the harmonized European standard family (EN 1090-1, -2, -3) for execution of steel and aluminium structural components under CPR. It provides a risk-based framework for fabrication, assembly, and conformity assessment enabling CE marking for load-bearing components in construction works.
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC) certification by Notified Bodies.
- **EN 1090-2/-3Technical requirements for steel/aluminium (materials, welding, tolerances, corrosion protection, NDT).
- **Execution Classes (EXC1-4)Scales requirements by consequence, service, production categories.
- Built on ISO 3834 for welding; AVCP systems with surveillance audits.
Why Organizations Use It
- Mandatory for EU market access via CE marking; avoids exclusion, fines, liability.
- Reduces risks through traceability, qualified processes; boosts competitiveness.
- Enhances trust, enables high-risk projects (bridges, stadia).
Implementation Overview
Phased: gap analysis, FPC build, personnel training (rWC), NB certification, ongoing surveillance. Targets fabricators; 6-12 months typical; suits all sizes with welding focus.
GDPR UK Details
What It Is
UK GDPR (UK General Data Protection Regulation) is the UK's post-Brexit adaptation of the EU GDPR, a binding legal regulation enforced by the Information Commissioner’s Office (ICO). Its primary purpose is to protect individuals' personal data through risk-based principles, rights, and accountability, applying to controllers and processors in or targeting the UK.
Key Components
- Seven core processing principles (lawfulness, purpose limitation, minimisation, accuracy, storage limitation, security, accountability)
- Enforceable data subject rights (access, rectification, erasure, portability, objection)
- Controller/processor obligations (records, contracts, DPIAs, breach notification)
- No formal certification; compliance demonstrated via documentation and audits
Why Organizations Use It
- Mandatory legal compliance to avoid fines up to 4% global turnover
- Enhances risk management, security, and incident response
- Builds stakeholder trust and competitive differentiation
- Supports cross-border operations with transfer safeguards
Implementation Overview
- Phased approach: governance, data mapping (RoPA), policies, training, DPIAs, audits
- Applies to all UK-handling organizations; scalable by size/industry
- Ongoing; no certification but ICO enforcement via fines/notices (178 words)
Key Differences
| Aspect | EN 1090 | GDPR UK |
|---|---|---|
| Scope | Structural steel/aluminium fabrication and conformity | Personal data processing principles and rights |
| Industry | Construction, manufacturing (EU/UK steel fabricators) | All sectors handling personal data (UK-wide) |
| Nature | Harmonized technical standard for CE marking | Mandatory data protection regulation with fines |
| Testing | FPC certification, NDT, notified body audits | DPIAs, security testing, ICO audits/investigations |
| Penalties | Market exclusion, no CE marking | Fines up to 4% global turnover |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about EN 1090 and GDPR UK
EN 1090 FAQ
GDPR UK FAQ
You Might also be Interested in These Articles...
From SOC to AI-Native CDC: Redefining Triage and Response in 2026
Explore the shift from SOCs to AI-Native CDCs. Autonomous agents handle Tier 1 triage in 2026, empowering analysts for complex threats. Discover the future of c
How to Implement CIS Controls v8.1 as a ‘Control Backbone’ for NIS2 & DORA (Step-by-Step Implementation Guide)
Deploy CIS Controls v8.1 as a control backbone for NIS2 & DORA compliance. Step-by-step roadmap (IG1→IG2), deliverables, metrics & evidence model for hybrid/clo
What is DORA and which Requirements does the Standard define?
Discover DORA requirements for info security, strict authority monitoring, and steps to achieve compliance. Build a resilient organization with our detailed gui
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Explore More Comparisons
See how EN 1090 and GDPR UK compare against other standards