GPSR safety complaints 2026 – accident investigation, complaint register and retention | Word/PDF/Excel

Does your company receive complaints about products that may be dangerous? With this GPSR specialist package, manufacturers and importers document incoming safety complaints, incident data, actual investigations, corrective actions, and personal data deletion – without confusing regular complaints, regulatory reporting, or technical documentation.

Legal basis: Regulation (EU) 2023/988 (GPSR), Articles 9.11–9.13 for manufacturers and 11.9–11.11 for importers. The GPSR began to apply on 13 December 2024. The specific investigation and registration obligations apply to relevant safety complaints and incident data, not every question about a return or delivery. Product and sector regulations must be assessed individually.

All files in the package

Who is the product for?

For Swedish manufacturers, EU importers, quality and product safety officers, and e-commerce companies that have a manufacturer or importer role. Typical needs are a recurring report of a burn injury, incorrect charger, leaking product, unstable child product, or a batch with reported safety issues. These examples describe situations, not performed tests or certified risks.

If you primarily need overall product safety and recalls, choose the GPSR basic package. For the EU responsible person and potential representative mandate, there is GPSR Article 16. This product is instead specialized in complaints, incident investigation, and data minimization.

Why is the five-year limit important?

GPSR Articles 9.13 and 11.11 mean that internal complaint registers may only contain personal data that is necessary to investigate the allegedly dangerous product. They may be kept only as long as they are needed and never longer than five years from introduction. Five years is a ceiling, not a recommendation to always store data for five years. Safety documentation without personal data and information handled under a separate legal basis may be covered by other regulations. GDPR also applies.

Excel calculates an external five-year limit from the actual registration date and shows when personal data needs to be needs-tested or deleted. It can also flag a “deletion performed” that has not been verified. The workbook does not delete anything in your systems and provides no automatic approvals regarding data protection or product safety.

Excel – nine tabs and practical controls

Products, Complaints, Investigations, Incidents, Actions, Personal Data Deletion, Decisions, Overview, and Read Me. The customer sheet should be filled with a pseudonymized case ID, not consumer names, phone numbers, diagnoses, or other sensitive information. Necessary personal data is handled separately in an access-controlled system. A registered test or a manual GO is not a regulatory approval of the product's safety.

How you go from complaint to verified action

1. Determine if the company is a manufacturer, importer, or has another role, and check current product legislation.
2. Publish or check an actually available channel for safety complaints and incident data.
3. Register the product and the pseudonymized case ID, separating safety cases from regular complaints.
4. Assess whether immediate protective measures, regulatory reporting, or incident notification are needed, regardless of whether Excel is fully completed.
5. Investigate the incident with actual, version-bound facts and, if necessary, actual testing.
6. Inform relevant stakeholders in a timely manner and document actual responses and retesting.
7. Test whether personal data is still needed. Delete earlier than five years when no longer necessary; document actual deletion performed.

Frequently Asked Questions

Must all complaints be registered as GPSR safety complaints?

No. The investigation and registration obligation in Articles 9.12 and 11.10 refers to complaints and incident data about the safety of products that are alleged to be dangerous. A common delay or price issue is not automatically such a case.

Must personal data be saved for five years?

No. It may only be saved as long as it is needed for the investigation and never longer than five years after registration in the GPSR complaint register.

Can the importer use the manufacturer's register?

Article 11.10 provides the possibility to document relevant complaints in the manufacturer's Article 9.12 register or a separate register. Actual responsibility, access to information, and relevant recipients must still be handled.

Does Excel automatically report incidents to the EU?

No. Incidents and dangerous products may require separate, time-critical notifications according to, among others, GPSR Article 20 as well as Articles 9 and 11, and these are handled manually in the correct regulatory channel.

Can all product documentation be deleted after five years?

No. The five-year limit refers to personal data in the special complaint register. Technical documentation and other safety information have their own legal requirements.

Can I fill in the PDF directly?

The files are searchable and printable but lack interactive fillable fields. Use Word to edit the documents.

Does the package contain English work templates?

No. The five main templates and Excel are Swedish. An English User Guide is included for use of the Swedish files.

Sources, version, and limitations

GPSR: EU 2023/988, especially Articles 9.11–13, 11.9–11, and 20. Swedish Consumer Agency's GPSR questions and answers. GDPR: EU 2016/679. Document version 1.0, AI-assisted legal source control November 10, 2026. No external legal or regulatory review and no product certification has been performed. Digital ZIP links to Shopify Digital Products and is published only after separate manual review.