ISO/IEC 27701 Privacy Management (PIMS) for Medical Devices

ISO/IEC 27701 is an international standard that defines a management system designed to help organisations protect privacy when processing personal data. It builds on the requirements of ISO/IEC 27001 and ISO/IEC 27002 to provide a framework for personal data protection that integrates with an existing information security management system.

Chinese manufacturers exporting medical devices to EU countries must meet not only the MDR (EU Medical Device Regulation) but also the data protection regulation [(EU) 2016/679, i.e. the GDPR].

The GDPR is an EU regulation with binding force that sets out legal obligations for processing personal data, whereas ISO 27701 is an international standard that provides a voluntary certification framework and a structured approach for organisations implementing the GDPR.

ISO/IEC 27701 (Privacy Information Management System, PIMS) requires a documented management system. The traditional route is the extension model: adding privacy-specific requirements to an existing ISO/IEC 27001 information security management system (ISMS) to form an integrated ISMS+PIMS system.

Overall structure of the ISO/IEC 27701 documentation system (extension model). The documents are organised in four levels and are highly compatible with ISMS documentation

Key elements of the ISO/IEC 27701 standard

Key changes in the 2025 extended model (compared with the 2019 version)

Summary: Everbiz has many successful cases of helping medical device companies establish and certify ISO/IEC 27701 management systems while meeting the requirements of the EU GDPR. If you encounter problems in practice, please contact EVERBIZ Certification Services for expert advice.

This is a series of educational articles introducing FDA, NMPA, GMP, CE MDR/IVDR and MDSAP regulations and standards.

EVERBIZ is happy to share medical device expertise with industry clients, and hopes our extensive practical experience in quality systems and product registration will be helpful.

If you have any questions or requirements, please contact us. Let’s contribute together to the development of the medical device industry.

More articles:

Understanding the FDA’s Stricter EMC Requirements for Common Sources of Electromagnetic Emissions

How to Avoid Conflict Minerals Risk: A Complete Guide to the CMRT | EVERBIZ Compliance Class

Why Is Amazon Full of “Home Nebulizers”? The Truth Hidden Between FDA Regulations and Amazon Policy

The CE-MID Directive Explained: Don’t Mistake Laboratory Instruments for Legal Metrology Equipment

[EVERBIZ EU Regulations Column] Which Products Fall Under the EU GPSD? Why Do Some Consumer Products Need CE Marking and Others Don’t?

Key Changes in China’s New Medical Device GMP: Effective 2026 – A Must-See Comparison Table

EVERBIZ Certification Services (Shanghai) Co., Ltd. (EVERBIZ) is a professional compliance service platform for testing, certification, consulting and training of medical products, dedicated to helping leading medical R&D companies at home and abroad improve their compliance capabilities and competitiveness. The company has offices and branches in Shanghai (China), Hong Kong, Munich (Germany), Salzburg (Austria) and Thailand, covering nearly 25 industries of compliance products (such as medical devices, new energy, household appliances, lighting, tools, laboratory instruments, machinery, in vitro diagnostics, wireless products and reagents).

Shanghai: Room 705, Building 6, Lane 111, Luxiang Road, Baoshan District, Shanghai | Germany: Landsberger Str. 155, 80687 München, Germany

Austria: Innsbrucker Bundesstraße 136/3, 5020 Salzburg, Austria

Hong Kong: Room A1, 11/F Winner Building, 36 Man Yue Street, Hung Hom, Kowloon, Hong Kong

Thailand: No. 850 Soi Lat Krabang 30/5, Lat Krabang Subdistrict, Bangkok 10520