F2025L00414Therapeutic Goods Legislation Checker

Home / Obligation register

Every duty in F2025L00414, one page each

The register holds 21 units that place a duty or set a date. Each page states the duty in our own words, the binding party, the evidence an auditor or regulator asks for, the dates and the exact citation. The source pointer is on every field.

Key date: 1 April 2028. Schedule 2 Part 2 commences and widens adverse event reporting. The UDI amendments commenced on 25 March 2025 and apply from each device general start day. The register lists a possible future repeal on 2 April 2028. All dates.

Schedule 1: The database

Schedule 1: Privacy and personal information

Schedule 1: Labelling and patients

Schedule 1: Identifiers

Schedule 2: Adverse event reporting

Schedule 3: Fees

The four markets

The rule is Australian. A sponsor or facility that also operates in another market may owe a parallel duty there. The held rule sets below are the ones the scan selected for this buyer. Where a market has no held device rule, the section says what is named rather than held.

AU

Australia

  • Therapeutic Goods Legislation Amendment (Australian Unique Device Identification Database and Other Measures) Regulations 2025, 21 held requirements. The instrument this product reads.
  • Australia Therapeutic Goods (Medical Devices) Regulations 2002, 75 held requirements. The regulations the instrument amends.
  • Australia Therapeutic Goods Act 1989, 48 held requirements. The Act that authorises the instrument and creates the reporting duty.
  • Australia Privacy Act 1988, 8 held requirements. The privacy statute for personal information the buyer handles.
  • Australian Privacy Principles (APPs), 13 held requirements. The principles that apply to representative personal information.
US

United States

  • HIPAA Privacy Rule, 27 held requirements. If the organisation handles protected health information in the US.
  • HIPAA Security Rule, 67 held requirements. If the organisation handles electronic protected health information in the US.
  • MDS2 (Medical Device), 39 held requirements. The device security disclosure standard used in US procurement.
EU

European Union

  • GDPR, 41 held requirements. If the organisation processes personal data in the EU.
  • EU Medical Devices Regulation (MDR 2017/745), 26 held requirements. If the device is placed on the EU market.
UK

United Kingdom

  • UK GDPR (UK General Data Protection Regulation), 60 held requirements. If the organisation processes personal data in the UK.
  • UK Data Protection Act 2018, 83 held requirements. The UK statute that sits with the UK GDPR.

The other markets are named for context and are not included in the kit. The United States section names HIPAA and MDS2. No federal US unique device identification rule is held in the estate, so it is named, not stated. The European Union section names the MDR and the GDPR. The United Kingdom section names the UK GDPR and the Data Protection Act 2018. No UK device identification rule is held. The Australian section holds the instrument, the regulations it amends, the Act and the privacy law.

How to use the register

  1. Start with the free check to get the start day for the device in front of you.
  2. Open the unit pages that the check names. Each page has the requirement, the evidence, the gaps and the preparation steps.
  3. Put the owner, the due date and the evidence in one register. The paid kit is that register, rendered from this record.