ETSI EN 303 645 Data Protection Provisions

Start with the actual provision set. Clause 5.8 addresses confidentiality for personal data moving between the device and services, stronger treatment for sensitive personal data exchanged with associated services, and accessible documentation of external sensing capabilities such as optical or acoustic sensors.

Clause 5.10 applies when telemetry is collected and recommends examining it, including log data, for security anomalies. Clause 5.11 covers user-data erasure from the device, personal-data removal from associated services, deletion instructions, and confirmation. Clause 6 adds processing transparency; consent, withdrawal, and consent records where consent is the basis; telemetry minimization and transparency; purpose-based data minimization and deletion; early aggregation with limited retention; and anonymization.

For clause 5.8, do not stop at a generic statement that traffic is encrypted. The useful evidence is a route-by-route map that shows which personal-data category uses which secure communication mechanism, what security guarantees it provides, and which cryptographic details are implemented.

TS 103 701 assesses whether secure communication mechanisms referenced by personal-data entries provide confidentiality for the relevant use case, whether the mechanism is appropriate for the technology, operating environment, risk, and usage, and whether the implemented cryptographic settings match the IXIT documentation.

Telemetry has two separate sets of provisions. Clause 5.10 recommends security-anomaly examination if telemetry is collected. Clause 6 requires transparency about what telemetry is collected, how it is used, by whom, and for what purposes, and recommends limiting personal-data processing in telemetry to what is necessary for the intended functionality.

The practical evidence should distinguish telemetry used for security examination from telemetry collected for other product purposes. TS 103 701 uses IXIT 24-TelData for telemetry description, purpose, security examination, and linked personal-data categories, and IXIT 2-UserInfo for the consumer-facing telemetry documentation.

Clause 5.11 requires simple functionality for erasing user data from the device and recommends simple functionality for removing personal data from associated services. It also recommends clear instructions for deleting and, where possible, erasing personal data from the device and associated services, and clear confirmation that personal data has been deleted and, where possible, erased from devices and associated services.

The deletion review should cover more than a factory reset button. EN 303 645 notes that factory reset may be inappropriate in shared-use situations where one user needs to remove their own personal data without disrupting the owner or future users.

Provision 6-6 is mandatory where the device processes personal data. It limits data stored or processed on the device, or made available to an associated service, to what is necessary for a purpose identified under Provision 6-1 and requires deletion when the data is no longer necessary for any identified purpose.

Provisions 6-7 and 6-8 are recommendations. Where collection or on-device processing exists solely to compute an aggregate, 6-7 calls for the minimum input needed, aggregation as early as possible, and minimized retention of both inputs and the aggregate. Provision 6-8 recommends anonymization technologies to protect privacy during collection, processing, and storage.

Review this checklist before publishing a claim, submitting evidence to an assessor, or using the page in procurement. Each item is based on the ETSI provisions or TS 103 701 evidence model and should be tied to a product version and assessment boundary.