Home / Privacy path
The privacy officer's path through the UDI database
Five checks, in the order the clauses impose them. Each line names the provision. None of this is legal advice, and the page does not decide whether the Privacy Act 1988 applies to your organisation.
1. Map the field to a permitted category
The database may hold personal information only in three cases. If a proposed field does not fit one of them, leave it out.
- The registered person's name. A person in relation to whom a kind of medical device is included in the Register. Source: reg 9A.1(4)(a).
- A manufacturer's authorised representative. Information about the person the manufacturer has authorised. Written consent is needed before entry. Source: reg 9A.1(4)(b), (5).
- A registered person's authorised representative. Information about the person the registered person has authorised. Written consent is needed before entry. Source: reg 9A.1(4)(c), (5).
Source: reg 9A.1(4). The regulation does not define personal information; the Act and the ordinary privacy meaning do the work.
2. Get written consent before entry
For either representative category, the representative must consent in writing before the information is put in the database. Keep the notice the representative saw, the scope, the date and the withdrawal route. A distributor's agreement is not the representative's consent.
Source: reg 9A.1(5). The text does not prescribe a form.
3. Keep representative information out of publication
The Secretary may publish all or part of the database. Personal information covered by s 41CE(2)(b) or (c) of the Act must not be made publicly available. Check every published field, and check any extract your organisation builds from the public view.
Source: reg 9A.1(13); Act s 41CE(2)(b)-(c).
A one-page consent record
The instrument does not prescribe a form. This is a suggested record, not a legal requirement.
- Representative name and the device or manufacturer they represent.
- The category relied on: reg 9A.1(4)(b) or (c).
- The notice version, with the date it was given.
- The scope: which fields and which purpose.
- The written consent, with the date and the method.
- The withdrawal route and who receives it.
- The removal date if the representative withdraws.
Keep the consent with the device record, not in a marketing list.
4. Action a removal request
A representative may ask in writing for their information to be removed. The Secretary must remove information covered by reg 9A.1(4)(b) or (c). Device information has a separate retention protection during suspension and after cancellation, so the two categories should be separable.
Source: reg 9A.1(6)-(7), (11).
5. Record the review route
A decision under reg 9A.1(9), which covers information the Secretary is satisfied is incomplete or incorrect, is an initial decision under reg 10.7. A refusal on that ground has the review route in that regulation.
Source: Sch 1 item 2; reg 10.7(1)(e).
What the text does not say
| Question | The record says |
|---|---|
| How long is representative information kept? | Not stated in the text. A retention schedule has to fill the gap. |
| What form must the consent take? | Not stated in the text. It must be in writing. Keep the notice and the scope. |
| How fast must a removal request be actioned? | Not stated in the text. Set an internal service level and record the dates. |
| Must the sponsor be told before a correction? | Not stated in the text. A notification is good practice, not a stated obligation. |
| Is the whole database public? | Not stated in the text. The Secretary may publish all or part of it. |
The short answer on representative consent and the short answer on personal information cover the same ground in fewer words. The unit page carries the evidence list.