If your device, app, or back-end touches any personal data of someone in the EU - patient, clinician, or research subject - you are a controller or processor under GDPR. We get MedTech and digital health companies GDPR-ready and keep them that way - aligned with MDR/IVDR, FDA, SOC 2, HITRUST, and HIPAA.
The short answer
If a connected device or its app processes personal data of people in the EU, GDPR applies alongside the EU MDR or IVDR. Health data is a special category, so you need a lawful basis, a record of processing, data protection impact assessments, Article 32 security controls, breach response and proper contracts (DPAs and SCCs) for any transfers outside the EU.
EU-ready at launch. Not after a complaint.
GDPR is not 'HIPAA with European wording.' EU regulators evaluate evidence Americans aren't used to producing.
EU supervisory authorities ask for Records of Processing on day one of any inquiry. A privacy policy on the website is not enough. Most US MedTech teams have nothing on file.
Connected medical devices and large-scale processing of health data are explicitly listed as high-risk in nearly every EU member-state DPIA blacklist. A DPIA isn't optional - it's the document the supervisory authority will read first.
Post-Schrems II, sending EU patient data to US cloud regions requires SCCs, a Transfer Impact Assessment, and supplementary measures. 'It's encrypted' is not a defense.
Everything an EU supervisory authority, Notified Body, or hospital DPO would ask to see - in a maintainable form, not a one-time PDF.
Mapped in weeks 1-3. Documentation in months 1-3. Operating program by month 6.
Weeks 1-3: map every personal-data flow across device, app, cloud, support, sales, and analytics. Identify controller vs processor roles for each activity.
Months 1-3: produce Article 30 RoPA, the DPIA for the device, the DPA pack, SCCs, TIAs, and EU Representative recommendation.
Months 2-4: align technical measures with your existing SOC 2 / HITRUST controls. Stand up data-subject rights workflows and the 72-hour breach response runbook.
Months 4-6: train the team, integrate with your QMS so MDR/IVDR Notified Body files reference the GDPR artifacts, and establish the annual review cycle.
Every gdpr for connected medical devices engagement ships with the artifacts FDA reviewers expect to see - traceable, complete, and aligned with current guidance.
If your device, app, or back-end touches any personal data of someone in the EU - patient, clinician, or research subject - you are a controller or processor under GDPR. We get MedTech and digital health companies GDPR-ready and keep them that way - aligned with MDR/IVDR, FDA, SOC 2, HITRUST, and HIPAA.
