Remote data processing solution (RDPS)
A remote service that is necessary for a product with digital elements to perform any of its functions. An RDPS is part of the PDE and therefore subject to the same CRA obligations as the product itself. The three-part test (at-a-distance, functional dependency, manufacturer responsibility) determines whether a remote service qualifies.
Source citations
Three-part RDPS test
The Commission's guidance (C(2026) 5252, 27 July 2026, § 8) sets out three conditions that must all be satisfied for a remote service to be an RDPS:
- At a distance — the data processing takes place remotely (not on the device)
- Functional dependency — the product cannot perform at least one of its intended functions without the remote service
- Manufacturer responsibility — the manufacturer controls or is responsible for the remote service (third-party SaaS used as a component is not an RDPS)
If all three conditions are met, the remote service is an RDPS and must comply with the same Annex I requirements as the physical product.
Worked examples (Commission guidance § 8.3)
The Commission's guidance (C(2026) 5252, § 8.3) illustrates the three-part test with five archetypal products:
| Product | Remote component | RDPS? | Why |
|---|---|---|---|
| Mobile banking app | Self-hosted "banking interface" (auth, submits instructions) | Yes | Manufacturer-developed, and the app cannot authenticate or submit transactions without it |
| Mobile banking app | Account-management / ledger systems | No | App does not interact with them directly — only the banking interface does |
| Mobile banking app | Third-party SaaS customer-support chat | No (treat as component) | Not designed/developed by, or under the responsibility of, the manufacturer |
| Smart thermostat | Manufacturer's software running on third-party IaaS | Yes | Thermostat cannot perform its smart functions without it; software is manufacturer-designed |
| e-Reader | Third-party SaaS book storage service | No (treat as component) | Necessary for the function, but not developed by or under the responsibility of the manufacturer |
| Industrial robot | Manufacturer's part-picking service on third-party IaaS | Yes | Robot cannot pick up parts without it; service software is manufacturer-designed |
| Smartphone | 5G cellular network | No | A communication channel/enabler, not data processing whose absence prevents a function from being performed |
Two recurring takeaways from these examples:
- Direct interaction matters. Only the remote component the product interacts with directly can be an RDPS — downstream systems it doesn't talk to directly are out of scope, even if their availability is indirectly important.
- Non-RDPS third-party services are not risk-free. Even where a service fails the RDPS test (e.g. third-party SaaS), the manufacturer must still treat it like a third-party component, assess the cybersecurity risks it introduces, and implement product-level mitigations (strong authentication, encryption, integrity checks, due diligence on the provider).