Does PSTI compliance cover data protection?
No. Meeting PSTI’s security requirements does not establish compliance with your separate data protection duties. Where you process personal information, assess security across the device, app and cloud service. Ask for evidence covering the actual configuration you will sell. Factory enquiries can be coordinated by Cambridge China Bridge.
Keep the compliance decisions separate
Confirm the applicable PSTI security requirements with OPSS. Our PSTI importing guide explains the product documentation and importer duties. Those checks do not settle whether personal information is adequately protected.
The ICO says these requirements are additional and separate to UK GDPR requirements. Appropriate security includes technical and organisational measures when you process personal information. Keep a separate security assessment alongside the product compliance file.
Map the device, app and cloud
Before choosing a supplier, draw the information flow from the device through the app to supporting servers. List recordings, account details, identifiers and other information collected. Ask where each item is stored, who can access it and which supplier controls each part.
Assess threats and possible harm across that map. The ICO explains that security measures may differ between processing on a device and processing in the cloud. For camera-specific sourcing questions, use our CCTV and security cameras guide.
Request evidence for each part
For the device, ask for demonstrations of secure setup, firmware updates and reset behaviour. For the app, test account recovery, shared access and removal of a former user. For the cloud, ask how administrator access is controlled, how customer accounts are separated and how stored information is protected.
Request security test findings tied to the proposed hardware, firmware, app and service configuration. Ask a competent specialist to review the scope and unresolved findings. A factory password demonstration gives you little evidence about cloud access or account recovery.
Agree who maintains protection
Name the people responsible for firmware, app releases, cloud administration and customer support. Ask who can investigate a report, release a remedy and confirm that it reached affected devices. Record dependencies on software providers separately from the factory’s promises.
Before ordering, agree how changes will be approved and checked. Include app replacement, server migration, component substitution and service closure in the discussion. Ask how customers can retrieve or delete information and remove access when a device changes hands.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Use an evidence-based buying decision
Keep the information map, assessment, test findings, responsible contacts and unresolved issues together. Make approval conditional on evidence for the configuration you intend to supply. Revisit the assessment when the product or supporting service changes.
If a problem emerges after sale, use our connected-product security failure guide for the product-security investigation. Assess personal-information exposure separately rather than treating a factory patch as closure of every issue. Cambridge China Bridge’s staff in China can gather factory records and clarify supplier responsibilities.
Frequently asked questions
Does a PSTI statement prove data protection compliance?
No. PSTI requirements are separate from data protection requirements. Keep evidence of appropriate personal-information security alongside the product compliance documents.
Should I check the app and cloud as well as the device?
Yes. Map where information travels and is stored, then request evidence for each part. Device setup tests do not establish that app accounts or cloud administrator access are secure.
What security evidence should I ask a Chinese factory for?
Ask for the information flow, named software and service providers, configuration-specific test findings, update demonstrations and unresolved issues. Identify who can supply evidence the factory does not hold.
Can I approve an order using a generic security report?
Check whether it covers your actual hardware, firmware, app and cloud configuration. Ask a competent specialist to identify gaps before making the purchasing decision.