If you are using Tuya or SmartLife, Tuya is a controller but also a processor, thus, Tuya is responsible for legal disputes. You do not need to perform GDPR certification. If you are an OEM brand, you are the controller and Tuya is the processor, so you need to fulfill your obligations as a controller. For example, you need to ensure the security of user information and equipment information obtained from Tuya platform.