F2025L00414, Sch 1 item 1, reg 9A.1(1) to (3)

Establish and maintain the UDI database

The Secretary of the Department of Health and Aged Care, for the Commonwealth. The Secretary must make sure a database for Australian device identification exists.

Reader note for unit 01: this provision sits in Schedule 1, under The database. The first action it calls for is to ask the TGA or the Department which operator holds the record for your device class. The evidence it names first is a current data-flow map that names the database operator and the receiving agency. The provision read on this page is Sch 1 item 1, reg 9A.1(1) to (3). It is unit 01 of 21 in the register.

What the provision requires

The Secretary must make sure a database for Australian device identification exists. The Secretary must keep the whole database, or agree in writing with another person to keep all of it, or keep part and agree in writing for the rest to be kept on the Commonwealth's behalf.

Source pointer: reg 9A.1(1)-(3).

What it means in practice

The database is the Commonwealth counterpart to the international device identification systems. The duty sits on the Secretary, not on a sponsor, and the clause allows a mixed operating model in which public servants and a contractor each keep part of the record.

A sponsor does not establish the database. The practical work is to know that the register of record is the Commonwealth's, that a contractor may operate it, and that the sponsor's submissions must still be accurate. A privacy officer should know which entity receives the data, where a correction request goes and which operator answers a patient query.

Source pointer: reg 9A.1(1)-(3) and reg 13C.2.

Evidence to keep

An auditor or a regulator will ask for the record that shows the duty was met, not a description of the process. Keep these artefacts with the device or facility file.

• A current data-flow map that names the database operator and the receiving agency. Shows that the organisation knows where its device data is held.
• The written maintenance arrangement if a contractor operates the database. The clause allows a contractor, so the operator should be identifiable.
• The sponsor's own log of submissions and corrections. The sponsor remains responsible for the accuracy of what it sends.

Source pointer: reg 9A.1(2)-(3); reg 13C.4. The artefacts are our suggested evidence, not a form prescribed by the instrument.

Common gaps

• Treating a contractor portal as a separate legal register.
• No named owner for correction requests.
• A data-flow map that stops at the TGA and does not name the operator.

Preparation steps

1. Ask the TGA or the Department which operator holds the record for your device class.
2. Record the operator and the support route in the UDI procedure.
3. Add the correction route to the privacy collection notice.

Dates that matter for this unit

Source pointer: s 2 table item 2.

Where it sits

• The Act provision the database serves, Therapeutic Goods Act 1989 s 41CE.
• Personal information limits, reg 9A.1(4) to (5).

Questions this provision raises

Source pointer for the page

Citation

Sch 1 item 1, reg 9A.1(1) to (3)

Instrument

Therapeutic Goods Legislation Amendment (Australian Unique Device Identification Database and Other Measures) Regulations 2025 (F2025L00414)

Official text

https://www.legislation.gov.au/F2025L00414/latest/text

Binding party

reg 9A.1(2)-(3)

Requirement

reg 9A.1(1)-(3)

Evidence

reg 9A.1(2)-(3); reg 13C.4

Dates

s 2 table item 2

Silent fields

Where the instrument does not state a form, a period or a frequency, this page says so rather than filling the gap.

Back to the register. Next: Personal information and written consent.