General Data Protection Regulation

Health data is a special category of personal data and may only be processed on a defined legal basis, typically explicit consent or a substantial public interest in the field of public health. Processing must be limited to what is necessary for the stated purpose and subject to appropriate safeguards.

Manufacturers that collect device usage data, images or telemetry need a lawful basis and a data protection impact assessment where the processing is likely to result in high risk. Data minimisation and pseudonymisation are expected by design rather than added after development.

Where a manufacturer relies on a processor, for example a cloud hosting provider or a remote service platform, a data processing agreement is required and international transfers need a valid transfer mechanism. Roles must be documented clearly, since the same company can act as controller for one activity and processor for another.

Data subjects retain rights of access, rectification, erasure and objection, with limits where processing is necessary for a regulatory obligation such as vigilance reporting. Retention periods should be set against both the MDR record-keeping requirements and the minimisation principle.