Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data) has applied since 25 May 2018. It repealed Directive 95/46/EC.
Chinese manufacturers exporting medical devices to EU countries must meet not only the MDR (EU Medical Device Regulation) but also the requirements of the GDPR (General Data Protection Regulation). The GDPR compliance bar is even higher when processing patients’ health data (special category personal data).
That is why many Chinese companies are keen to understand the GDPR. In a series of articles we will cover the regulation itself, practical compliance requirements and how to achieve them, and case studies.
Regulation (EU) 2016/679 has 11 chapters and 99 articles
GDPR compliance best practices for medical device companies, in one chart:
GDPR compliance is not an afterthought but a requirement across the entire product life cycle. For medical device companies planning to enter the EU market, MDR certification is the mandatory compliance route, and GDPR requirements are embedded in the MDR certification process.
For example, under the MDR, companies must include data protection content in their technical documentation:
-
Description of data processing activities
-
Explanation of data protection measures
-
Patient privacy protection mechanisms
-
Data breach response plan
There are many more details, which we plan to cover topic by topic in upcoming issues of our WeChat account:
-
Checklist of essential GDPR compliance documents for cross-border transfers of medical data
-
Ensuring compliance of cross-border transfers of medical data;
-
Simplification advice for SMEs and prioritising core requirements (such as lawful processing and data minimisation) to avoid over-compliance;
-
Key points for implementing Privacy by Design;
-
The relationship between ISO 27701 and Regulation (EU) 2016/679.
More articles:
Understanding the FDA’s Stricter EMC Requirements for Common Sources of Electromagnetic Emissions
How to Avoid Conflict Minerals Risk: A Complete Guide to the CMRT | EVERBIZ Compliance Class
Why Is Amazon Full of “Home Nebulizers”? The Truth Hidden Between FDA Regulations and Amazon Policy
The CE-MID Directive Explained: Don’t Mistake Laboratory Instruments for Legal Metrology Equipment
Key Changes in China’s New Medical Device GMP: Effective 2026 – A Must-See Comparison Table