Chinese manufacturers exporting medical devices to EU countries must meet not only the MDR (EU Medical Device Regulation) but also the requirements of the GDPR (General Data Protection Regulation). The GDPR compliance bar is even higher when processing patients’ health data (special category personal data).
Download the EU GDPR text at: https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng.
Article 35 of the EU GDPR contains a mandatory requirement for a prior data risk assessment, the Data Protection Impact Assessment (DPIA).
The diagram below gives an at-a-glance overview of what a DPIA is, when a DPIA is mandatory, what it usually covers, and how it relates to EU regulations and standards:
Once they understand the DPIA requirements, what companies really want is a DPIA template they can use in practice.
The DPIA template below shows how to document the assessment process and results, following the procedure laid down in the GDPR.
In summary:
1. Where a type of processing, taking into account its nature, scope, context and purposes, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact on the protection of personal data.
2. The assessment shall contain:
(a) a systematic description of the envisaged processing operations and the purposes of the processing;
(b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes;
(c) an assessment of the risks to the rights and freedoms of data subjects;
(d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate compliance with this Regulation, taking into account the rights and legitimate interests of data subjects and other persons concerned.
3. Where there is a change in the processing operations that may result in a new high risk, the controller shall carry out a new impact assessment.
In short, the EU requires you to give patient data a “privacy risk health check” before you touch it, proving you will not misuse or leak it. Everbiz can provide guidance to controllers on impact assessments.
This is a series of educational articles introducing FDA, NMPA, GMP, CE MDR/IVDR and MDSAP regulations and standards.
EVERBIZ is happy to share medical device expertise with industry clients, and hopes our extensive practical experience in quality systems and product registration will be helpful.
If you have any questions or requirements, please contact us – let’s contribute together to the development of the medical device industry.