Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), has applied in full since 25 May 2018. Most provisions of Regulation (EU) 2023/2854, the Data Act, apply from 12 September 2025. Both are EU regulations that apply directly and uniformly across the entire EU.
For the medical device industry, both regulations apply mandatorily to all categories of medical devices placed on the market or used in the EU, creating combined compliance obligations alongside the MDR/IVDR. Understanding how they interact and the underlying compliance logic is essential for EU market access and for avoiding heavy penalties.
Key differences and links between the two regulations
The GDPR is the EU’s “basic law” on personal data privacy, focused on restricting data misuse and protecting the privacy rights of natural persons. The EU Data Act is the “market rules law” of the EU data economy, focused on breaking up data monopolies and regulating access to and flow of all types of data.
Key compliance points for the medical device industry
1. Core GDPR compliance obligations
Medical device companies that process patients’ personal health data collected, stored or processed by devices (special category personal data under the GDPR) must:
-
Establish a lawful basis for processing and complete a DPIA (Data Protection Impact Assessment)
-
Safeguard patients’ (data subjects’) core rights of access, rectification and erasure.
-
Implement security measures such as data encryption, access control and breach response.
-
Strictly comply with the rules on cross-border data transfers.
2. Core EU Data Act compliance obligations
For smart/connected medical devices (such as electronic endoscope image processors and remote monitoring devices), medical device companies must:
-
Provide standardised data interfaces at the product design stage, so that users (hospitals and healthcare institutions) can access all data generated by the device free of charge and easily.
-
Not restrict, through technical means or contract terms, users from sharing data with third parties (such as repair providers and research platforms).
-
Ensure that associated cloud services and software platforms meet data-switching requirements, eliminating vendor lock-in.
-
In public health emergencies, share relevant non-personal data with EU public sector bodies as required.
The GDPR draws red lines on how and why device manufacturers process medical data, while the Data Act requires manufacturers to open the door on who can access and use that data – in particular users and the third parties they designate.
Manufacturers’ compliance work must strike a balance between these two logics and build a coherent risk management framework.
Everbiz is happy to provide targeted interpretation and share expertise with device manufacturers exporting to the EU.
EVERBIZ Certification Services (Shanghai) Co., Ltd. (EVERBIZ) is a professional compliance service platform for testing, certification, consulting and training of medical products, dedicated to helping leading medical R&D companies at home and abroad improve their compliance capabilities and competitiveness. The company has offices and branches in Shanghai (China), Hong Kong, Munich (Germany), Salzburg (Austria) and Thailand, covering nearly 25 industries of compliance products (such as medical devices, new energy, household appliances, lighting, tools, laboratory instruments, machinery, in vitro diagnostics, wireless products and reagents).
Shanghai: Room 705, Building 6, Lane 111, Luxiang Road, Baoshan District, Shanghai | Germany: Landsberger Str. 155, 80687 München, Germany
Austria: Innsbrucker Bundesstraße 136/3, 5020 Salzburg, Austria
Hong Kong: Room A1, 11/F Winner Building, 36 Man Yue Street, Hung Hom, Kowloon, Hong Kong
Thailand: No. 850 Soi Lat Krabang 30/5, Lat Krabang Subdistrict, Bangkok 10520
