The Relationship Between ISO 27701 and Regulation (EU) 2016/679

Chinese manufacturers exporting medical devices to EU countries must meet the MDR (EU Medical Device Regulation). Article 110 in Chapter IX of the MDR explicitly requires medical devices to comply with data protection law [(EU) 2016/679, i.e. the GDPR], and the GDPR compliance bar is higher still when processing patients’ health data (special category personal data).

The GDPR has a far-reaching impact on companies. As “horizontal legislation”, it governs the patient data, clinical data and usage data that medical device companies process across the product life cycle (R&D, production, clinical, after-sales), all of which are “special category personal data” under the GDPR.

At its core, the GDPR reshapes the rules of data processing, and the slightest misstep can lead to heavy fines or a crisis of trust. Typically, companies most want to understand the broad requirements of the MDR and the GDPR and where they intersect, and a practical route to meeting the GDPR.

Specific requirements and points of intersection

A practical route to meeting the GDPR

Articles 42–43 of the GDPR provide three officially recognised mechanisms for demonstrating data protection compliance: data protection certification mechanisms, data protection seals and data protection marks

These three mechanisms are set out side by side in Article 42(1) of the GDPR. All are voluntary compliance tools used to demonstrate that the personal data processing of controllers and processors complies with the GDPR. Mechanisms approved under Article 42(5) can also be used to demonstrate the existence of appropriate safeguards when transferring personal data to third countries.

So what is the relationship between the GDPR and ISO 27701? Companies want to know this too. We explain it step by step below.

ISO 27701: description, scope, compliance value and risk management

1. The full title of ISO 27701 is “Security techniques — Extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management — Requirements and guidelines”. The equivalent Chinese national standard is GB/T 35273.2.

2. The full title of ISO 27001 is “Information security, cybersecurity and privacy protection — Information security management systems — Requirements”. The equivalent Chinese national standard is GB/T 22080.

3. The full title of ISO 27002 is “Information security, cybersecurity and privacy protection — Information security controls”. The equivalent Chinese national standard is GB/T 22081.

ISO 27701 certification route and implementation logic, its specific key new requirements, certification sequence, and the key differences between ISO 27701 and ISO 27001 – in one chart:

Implementation recommendations for companies

(1) Foundation first, then extension: organisations should first establish an ISO 27001 information security management system as the basis for privacy protection.

(2) Risk-based: assess privacy risks according to the volume, type and sensitivity of the PII (personally identifiable information) processed, and determine the scope of ISO 27701 implementation.

(3) Integrated management: run the ISMS and PIMS as an integrated system with unified documentation, processes and audit mechanisms to improve efficiency.

(4) Continual improvement: regularly update the PII inventory, assess privacy risks and optimise controls to ensure the system keeps pace with regulatory changes.

The relationship between ISO 27701 and Regulation (EU) 2016/679

Summary: ISO 27701 and the GDPR are complementary, not substitutes. ISO 27701 gives companies a systematic method and certification framework for meeting GDPR requirements, and is a powerful tool for medical device companies to achieve dual compliance with the MDR and the GDPR.