Personal information and written consent

The Secretary as database operator. A sponsor or manufacturer that supplies representative information should apply the same limit in practice. The database may hold personal information only in three cases: the name of a person connected to a kind of device on the Register, an authorised representative of the manufacturer, or an authorised representative of a person connected to a registered device.

Reader note for unit 02: this provision sits in Schedule 1, under Privacy and personal information. The first action it calls for is to draft a one-page representative notice with the three categories, the purpose and the withdrawal route. The evidence it names first is a field-level data map that gives every field a category and the clause it relies on. The provision read on this page is Sch 1 item 1, reg 9A.1(4) to (5). It is unit 02 of 21 in the register.

Key date: 1 April 2028. Schedule 2 Part 2 commences and widens adverse event reporting to Class IIa, Class IIb, Class III, Class 3 IVD and Class 4 IVD devices. The UDI amendments commenced on 25 March 2025 and apply from each device general start day. The full date table.

What the provision requires

The database may hold personal information only in three cases: the name of a person connected to a kind of device on the Register, an authorised representative of the manufacturer, or an authorised representative of a person connected to a registered device. Information about a representative in the second or third case may be entered only after that representative consents in writing.

Source pointer: reg 9A.1(4)-(5).

What it means in practice

The clause draws a narrow boundary around the only personal information the database may carry. It protects representatives by requiring an active written yes and separates the registered person's name from the representative categories.

A privacy officer should map every proposed field against the three categories, refuse a field that does not fit, and keep the consent evidence. Consent must be in writing. A tick box is only useful if the representative saw the notice and understood the scope. The clause does not set a retention period, a notice form or a withdrawal form; those fields say not stated in the text and the organisation has to fill them.

Source pointer: reg 9A.1(4)-(5), (11), (13).

Evidence to keep

An auditor or a regulator will ask for the record that shows the duty was met, not a description of the process. Keep these artefacts with the device or facility file.

A field-level data map that gives every field a category and the clause it relies on. Shows that no field was collected because it was convenient.
A signed or electronically executed consent with the notice version and the date. The clause requires written consent before entry.
A withdrawal log and the date the database entry was removed. A consent that cannot be withdrawn is not a working control.
A decision record for any representative field left out. Explains an apparent gap in the record.

Source pointer: reg 9A.1(5); reg 9A.1(11). The artefacts are our suggested evidence, not a form prescribed by the instrument.

Common gaps

Collecting a representative email or mobile number because it is convenient.
Treating a distributor's implied agreement as written consent.
No copy of the notice the representative agreed to.
One consent used for several representatives.

Preparation steps

Draft a one-page representative notice with the three categories, the purpose and the withdrawal route.
Build a consent register keyed to the device and the representative.
Test one withdrawal end to end and record the date the entry was removed.

Dates that matter for this unit

Date	What happens	Note
2025-03-25	Schedule 1 commenced	s 2 table item 2

Source pointer: s 2 table item 2.

Where it sits

Removal of representative information, reg 9A.1(11).
Public release limits, reg 9A.1(13).
Privacy Act 1988 and the APPs, Privacy Act 1988.

Questions this provision raises

What counts as personal information here?

The regulation does not define the term. It relies on the Act and on the ordinary privacy meaning. A name, a direct contact detail and an identifier that points to a person can all qualify. A corporate role address may still identify a person if it is tied to a named representative.

Can we hold a representative email address?

Only if the representative is within one of the three categories and, for the representative categories, has consented in writing. The clause does not create a general contact list. If the email is not needed for the database purpose, leave it out.

What happens when a representative withdraws?

The Secretary must remove representative information covered by the second or third category when the representative asks in writing. The organisation should log the request, confirm the removal and stop using the details.

Source pointer for the page

Citation: Sch 1 item 1, reg 9A.1(4) to (5)
Instrument: Therapeutic Goods Legislation Amendment (Australian Unique Device Identification Database and Other Measures) Regulations 2025 (F2025L00414)
Official text: https://www.legislation.gov.au/F2025L00414/latest/text
Binding party: reg 9A.1(4)-(5)
Requirement: reg 9A.1(4)-(5)
Evidence: reg 9A.1(5); reg 9A.1(11)
Dates: s 2 table item 2
Silent fields: Where the instrument does not state a form, a period or a frequency, this page says so rather than filling the gap.

Back to the register. Next: Keep device records after suspension or cancellation.