Privacy notice for registration of medical device economic operators 

As the competent authority for medical devices in Ireland, the HPRA processes personal data to maintain a national register of economic operators. 

The following economic operators who hold a legal place of business in the Republic of Ireland are required to register with the HPRA:

  • ­Custom made device manufacturers of class I, IIa and IIb custom-made devices
  • ­Health institutions, i.e. hospitals or clinics involved in the manufacture of devices
  • ­Manufacturing facilities
  • ­Distributors

National registration is completed using the online registration form, located on the HPRA website. 

The following entities who hold a legal place of business in the Republic of Ireland are required to register on EUDAMED:

  • ­Manufacturers (including manufacturers of Class III custom made medical devices)
  • ­Importers
  • ­Authorised representatives
  • ­Non-EU manufacturers whose authorised representative is based in Ireland
  • ­System and procedure pack producers

The HPRA will receive a notification to review the details of these registrations.

Please refer to the EU Commission website for more information on EUDAMED. 

What information do we process?

On receipt of the HPRA online registration form, the HPRA processes contact details (for example, name, address, email address, etc.) for both regulatory compliance and invoicing purposes.

On receipt of the notification from EUDAMED, the HPRA processes the personal data of the person responsible for regulatory compliance (PRRC). This data includes name, email address, phone number and address. 

The HPRA uses the data collected during the registration process to apply the appropriate fees for registration, which is determined by the role of the economic operator. The register may also be used for the purposes of market surveillance activities, including inspections and monitoring of safety and compliance.  

Legal basis for processing

The legal basis for the processing is Article 6(1)c of the General Data Protection Regulation (GDPR): processing is necessary for compliance with a legal obligation to which the HPRA is subject.

Medical devices are regulated by Regulation (EU) 2017/745 on medical devices. In vitro diagnostic medical devices (IVDs) are regulated by Regulation (EU) 2017/746 on IVDs. These regulations are implemented into Irish law by S.I. No. 261/2021 and SI 256/2022 respectively. 

S.I. 691/2021 and SI 365/2022 detail the national provisions for the requirements for registration of medical device economic operators in the Republic of Ireland. 

How is your information processed and shared?

Where required for certain market surveillance activities, your information may be shared with other competent authorities, the European Commission and other regulatory bodies. 

The HPRA uses third party service providers and suppliers (also known as data processors) to carry out both our regulatory functions and other related matters. These third parties process personal data on behalf of the HPRA and appropriate arrangements are in place with them to protect personal data.

The personal data collected by the HPRA is not generally expected to be transmitted to third countries by the HPRA. In cases where it is necessary to do so, the HPRA will make every effort to ensure all personal data is appropriately protected and the transfer complies with data protection legislation. 

The data is retained permanently. Where an economic operator no longer holds a legal place of business in the Republic of Ireland, the organisation’s details may be removed from the medical device economic operator register by request, however these details are retained on the HPRA database. Requests to amend your personal data may be made via the HPRA online form or EUDAMED if required. 

The HPRA fully respects your right to privacy and treats all personal information with the appropriate standards of security and confidentiality, strictly in accordance with data protection legislation.  

What are your rights under data protection law?

Data protection legislation provides you with the following rights regarding the processing of your personal data:

  • the right to request access to your data
  • the right to request your data be rectified or erased if it is inaccurate
  • the right to request processing of your data be restricted 
  • the right to lodge a complaint with the Data Protection Commission

How to contact us

For more information or to make a request regarding your personal data under data protection law, please submit your request in writing or via email to:

Data Protection Officer
Health Products Regulatory Authority
Kevin O'Malley House,
Earlsfort Centre,
Earlsfort Terrace,
Dublin 2

Tel: +353 (1) 676 4971
Fax: +353 (1) 676 7836
Email: dataprotectionofficer@hpra.ie

Please provide sufficient information in your request to enable us to deal with your query.

Further information regarding data protection at the HPRA can be found in our main privacy notice.