EN 1090
European standard for steel/aluminium structural execution and CE marking
GDPR UK
UK regulation for personal data protection and privacy
Quick Verdict
EN 1090 governs structural steel fabrication for CE marking in construction, while GDPR UK mandates personal data protection across all sectors. Fabricators certify FPC for market access; all firms adopt GDPR UK to avoid massive fines and ensure compliance.
EN 1090
EN 1090 Execution of steel and aluminium structures
Key Features
- Enables CE marking via Factory Production Control certification
- Risk-scaled Execution Classes (EXC1-EXC4) for proportionality
- Detailed technical rules for steel (EN 1090-2) and aluminium (EN 1090-3)
- Welding quality management aligned with ISO 3834
- Material traceability and inspection regimes by risk level
GDPR UK
UK General Data Protection Regulation (UK GDPR)
Key Features
- Seven core data processing principles with accountability
- Enforceable individual data subject rights
- 72-hour personal data breach notification to ICO
- Mandatory DPIAs for high-risk processing
- Risk-based security and international transfer safeguards
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
EN 1090 Details
What It Is
EN 1090 is the harmonized European standard family (EN 1090-1, -2, -3) for execution of steel and aluminium structural components under CPR. It provides a risk-based framework for fabrication, assembly, and conformity assessment enabling CE marking for load-bearing components in construction works.
Key Components
- **EN 1090-1Conformity assessment, Factory Production Control (FPC) certification by Notified Bodies.
- **EN 1090-2/-3Technical requirements for steel/aluminium (materials, welding, tolerances, corrosion protection, NDT).
- **Execution Classes (EXC1-4)Scales requirements by consequence, service, production categories.
- Built on ISO 3834 for welding; AVCP systems with surveillance audits.
Why Organizations Use It
- Mandatory for EU market access via CE marking; avoids exclusion, fines, liability.
- Reduces risks through traceability, qualified processes; boosts competitiveness.
- Enhances trust, enables high-risk projects (bridges, stadia).
Implementation Overview
Phased: gap analysis, FPC build, personnel training (rWC), NB certification, ongoing surveillance. Targets fabricators; 6-12 months typical; suits all sizes with welding focus.
GDPR UK Details
What It Is
UK GDPR (UK General Data Protection Regulation) is the UK's post-Brexit adaptation of the EU GDPR, a binding legal regulation enforced by the Information Commissioner’s Office (ICO). Its primary purpose is to protect individuals' personal data through risk-based principles, rights, and accountability, applying to controllers and processors in or targeting the UK.
Key Components
- Seven core processing principles (lawfulness, purpose limitation, minimisation, accuracy, storage limitation, security, accountability)
- Enforceable data subject rights (access, rectification, erasure, portability, objection)
- Controller/processor obligations (records, contracts, DPIAs, breach notification)
- No formal certification; compliance demonstrated via documentation and audits
Why Organizations Use It
- Mandatory legal compliance to avoid fines up to 4% global turnover
- Enhances risk management, security, and incident response
- Builds stakeholder trust and competitive differentiation
- Supports cross-border operations with transfer safeguards
Implementation Overview
- Phased approach: governance, data mapping (RoPA), policies, training, DPIAs, audits
- Applies to all UK-handling organizations; scalable by size/industry
- Ongoing; no certification but ICO enforcement via fines/notices (178 words)
Key Differences
| Aspect | EN 1090 | GDPR UK |
|---|---|---|
| Scope | Structural steel/aluminium fabrication and conformity | Personal data processing principles and rights |
| Industry | Construction, manufacturing (EU/UK steel fabricators) | All sectors handling personal data (UK-wide) |
| Nature | Harmonized technical standard for CE marking | Mandatory data protection regulation with fines |
| Testing | FPC certification, NDT, notified body audits | DPIAs, security testing, ICO audits/investigations |
| Penalties | Market exclusion, no CE marking | Fines up to 4% global turnover |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about EN 1090 and GDPR UK
EN 1090 FAQ
GDPR UK FAQ
You Might also be Interested in These Articles...
The 'Black Box' Risk: Why Human-in-the-Loop is the Ultimate Fail-Safe for 2026 Security Operations
Uncover the black box AI risk in security ops. Learn why human-in-the-loop auditing is crucial for 2026. Upskill analysts to ensure data privacy and robust secu
The CIS Controls v8.1 Evidence Pack: What Auditors Ask For (and How to Produce Proof Fast)
Fail CIS Controls v8.1 audits due to missing evidence? Get the blueprint: exact artifacts auditors want, repository structure, and automation from security tool
How to Implement CIS Controls v8.1 as a ‘Control Backbone’ for NIS2 & DORA (Step-by-Step Implementation Guide)
Deploy CIS Controls v8.1 as a control backbone for NIS2 & DORA compliance. Step-by-step roadmap (IG1→IG2), deliverables, metrics & evidence model for hybrid/clo
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
DORA vs CMMI
Discover DORA vs CMMI: EU financial resilience regulation meets proven process maturity model. Boost compliance, ICT risk mgmt & performance. Find your best fit now!
ITIL vs ISO 13485
ITIL vs ISO 13485: ITIL's SVS & 34 practices align IT services for agile ops; ISO 13485's risk-based QMS ensures med device safety/compliance. Compare & choose wisely!
RoHS vs ISO 20000
RoHS vs ISO 20000: Compare hazardous substance limits in EEE (10 restricted materials) with IT service management standards. Unlock compliance strategies for global success now!