Internet-connected radio equipment that is capable of processing personal data within the meaning of the GDPR, or traffic data or location data within the meaning of the ePrivacy Directive, must build in safeguards protecting users' and subscribers' personal data and privacy. The 2023 corrigendum fixed the wording so that the trigger reads traffic data or location data, so any one of the three data types brings the product in. Recital 10 describes the risk the safeguards must address: microphones, cameras and sensors that record photos, video, location, heart rate, sleep and play data, with advanced settings reachable through a default password, unencrypted links or weak authentication. The manufacturer must therefore design in encryption of stored and transmitted personal data, user authentication, access control to settings and data, secure deletion and update mechanisms, and document them in the technical file. Whether the equipment is marketed to consumers or professionals does not matter; the capability to process the data does.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.