GPSR safety complaints – registers, accidents and the five-year limit

Short answer: Short answer: A complaint alleging that a consumer product is dangerous requires safety triage, not just a standard returns response. Manufacturers and importers covered by the EU General Product Safety Regulation (GPSR) need accessible complaint channels, investigations of relevant safety complaints and records of findings and measures. Personal data in the dedicated complaints register may be kept only as long as needed and never more than five years after entry. Five years is a ceiling, not a default retention period.

This guide is chiefly for Swedish manufacturers and importers of consumer products. Retailers must first identify whether they act as distributors or in another role. Where sector-specific EU legislation applies, assess how it interacts with GPSR. GPSR has applied since 13 December 2024.

1. Which complaints are covered – and which are not?

GPSR Articles 9(11)–(13) and 11(9)–(11) concern complaints and information about accidents involving products alleged to be dangerous. A defect may trigger consumer-law and product-safety processes, but not every return is a safety issue. Use an initial triage.

Examples are illustrative, not actual test results. Protective action must never be delayed because a form or internal approval is incomplete.

2. Who is responsible: manufacturer, importer or distributor?

Manufacturer: Article 9(11) requires a publicly available channel for complaints and accident information; Article 9(12) requires investigation of relevant safety complaints and an internal register of complaints and corrective actions.

Importer: Articles 11(9)–(11) impose corresponding obligations. Under Article 11(10), relevant complaints may be recorded in the manufacturer's register or an importer's own register. Cooperation does not remove the importer's responsibility.

Distributor and online marketplace: other, partly overlapping duties apply. Selling a product does not automatically confer the manufacturer's precise register duties; check your legal role and sector-specific rules.

3. A seven-step traceable investigation

1. Receive: log date, channel, product, model, batch and case ID. Where possible, separate customer identifiers from the technical case file.
2. Assess immediate risk: consider severity and whether to stop sales, quarantine stock or warn users without delay.
3. Identify roles: establish manufacturer, importer, distributor, any EU responsible person and relevant contacts.
4. Investigate: preserve actual evidence, photos, batch numbers, test results, decisions and gaps. Never invent tests or certificates.
5. Assess notification: consider serious accidents under Article 20 and separate dangerous-product notifications under Articles 9, 11 and 12. Use the proper channel promptly when required.
6. Act and verify: record corrections, withdrawals, recalls or customer communications and who checked effectiveness.
7. Review retention: remove personal data when no longer needed, log actual deletion and retain technical records only under the applicable separate rules.

4. When must an accident be reported?

Article 20 concerns accidents related to product use that result in death or serious adverse effects on health and safety, temporary or permanent. Manufacturers must ensure notification via the Safety Business Gateway without undue delay once aware. Importers and distributors must notify the manufacturer without undue delay; additional provisions apply when the manufacturer is not established in the EU.

Accident notifications and separate notifications about dangerous products are distinct tests. A dangerous product may require protective measures and reporting even if nobody has suffered serious injury. For the broader framework, read the GPSR guide to Safety Gate and recalls.

5. Five-year limit – what to erase and what to retain?

Under Articles 9(13) and 11(11), only personal data needed to investigate a complaint about an allegedly dangerous product may be kept in the complaints register. Data may be retained only as long as necessary and never longer than five years after entry. GDPR principles on purpose limitation, data minimisation and storage limitation also apply.

Example: data entered on 10 November 2026 reaches the outer limit on 10 November 2031, but must be deleted sooner once no longer needed. Keep identifying data access-controlled and distinguish genuinely anonymised batch histories from information that still identifies a person.

This five-year ceiling does not authorise destruction of technical files, testing reports or documentation subject to different legal or evidentiary duties. Review each data category separately.

6. Two realistic situations

Scenario A: several complaints about a hot charger

Assume three buyers report unusual heat in one model. Quality staff link cases to batches, assess immediate precautions, notify relevant economic operators and determine whether the product is dangerous. Do not wait for proven personal injury before investigating.

Scenario B: injury followed by an erasure request

A customer reports an injury and later seeks deletion of contact details. Assess accident notification promptly, then handle the data-subject request under applicable GDPR rules and investigation needs. Neither automatic destruction of all safety evidence nor default five-year retention of every personal detail is justified.

7. Common mistakes to avoid

• Treating every return as a reportable safety case, or dismissing a safety warning as an ordinary return.
• Confusing the five-year ceiling for complaint-register personal data with retention of all technical files.
• Assuming a spreadsheet replaces risk assessment, corrective measures, official notification or verified erasure.
• Using the manufacturer's register without documented roles, access, traceability and data-protection assessment.
• Writing 'approved' without naming the actual decision-maker, evidence and checks.

8. Frequently asked questions about GPSR complaint registers

Must every customer complaint go into a GPSR safety register?

No. Assess whether it relates to a product's safety and an allegation that it is dangerous. Late deliveries and price errors alone ordinarily do not qualify.

Can we retain personal data for exactly five years?

Not automatically. Five years is the absolute upper limit in this specific register; delete earlier when the data is no longer needed for investigation.

May importers use the manufacturer's register?

Yes. Article 11(10) allows the manufacturer's register or the importer's own register, but the importer must still ensure compliance.

Must every product defect be reported as an accident?

No. Article 20 has specific criteria involving death or serious harm to health and safety. Dangerous products may nevertheless require other measures and notifications without such an accident.

9. Official sources and limitations

• Regulation (EU) 2023/988 (GPSR), Articles 9(11)–(13), 11(9)–(11), 12, 20.
• Swedish Consumer Agency GPSR guidance.
• European Commission Safety Business Gateway guidance.
• GDPR (EU) 2016/679, Article 5.

Editorial legal-source check: 10 November 2026. General information on Swedish/EU law, not individual legal advice, product testing or certification. Seek specialist assessment for serious incidents, sector-specific rules or uncertain reporting duties.