Medical Devices Ordinance (MedDO) (MedDO)
English is not an official language of the Swiss Confederation. This translation is provided for information purposes only and has no legal force.
Section 1 Data Processing in general
Art. 79 Processing of personal data
Swissmedic and third parties contracted by Swissmedic are empowered to process the personal data that they need to perform the tasks mandated to them by this Ordinance. Specifically, this includes: a. health data acquired in the course of market surveillance and vigilance; b. data documenting the reliability and professional qualifications of vigilance contact persons (Art. 67 para. 2) or the individuals responsible for compliance with the regulations (Art. 49 and 52).
Art. 80 Operation of information systems
1 It is Swissmedic’s responsibility to ensure that its information systems operate securely and that data are processed in accordance with legal requirements. 2 It shall draw up a set of processing rules for each information system. These shall specify the technical and organisational measures to be taken to ensure that the data are protected and secure.
Art. 81 Access rights
1 The following persons and agencies shall be given online access to information systems provided this is necessary for the fulfilment of their respective tasks: a. Swissmedic staff employed in vigilance and market surveillance and third parties mandated to perform tasks in this area; b. Swissmedic staff employed in administrative penal law; c. Swissmedic administrators and mandated third parties. 2 A log of persons and bodies granted access to the information systems shall be kept. The data in this log shall be stored for two years.
Art. 82 Data archivingand deletion
Personal data shall be stored for a period of ten years from the final entry. On the expiry of this period, it shall be destroyed.
Section 2 Medical Devices Information System
Art. 83 Responsible authority
Swissmedic is responsible for the medical devices information system required under Article 62c TPA (medical devices information system).
Art. 84 Data protection and security
1 Swissmedic shall draw up processing rules in accordance with Article 6 of the Data Protection Ordinance of 31 August 2022 (DPO). 2 Articles 1–4 and 6 DPO apply to data security. 3 Data processing must be automatically logged.
Para. 1 — SR 235.11 Para. 1 — Amended by Annex 2 No II 101 of the Data Protection Ordinance of 31 Aug. 2022, in force since 1 Sept. 2023 (AS 2022 568). Para. 2 — Amended by Annex 2 No II 101 of the Data Protection Ordinance of 31 Aug. 2022, in force since 1 Sept. 2023 (AS 2022 568).
Art. 85 Content of the medical devices information system
1 This medical devices information system contains the following data: a. device data; b. data on economic operators; c. data on the designated bodies and certificates issued by them; d. data on clinical trials; e. vigilance data; f. market surveillance data; g. data that can be used to manage and adapt the medical devices information system (system data); h. authentication data, assigned user roles and basic settings for using the medical devices information system (user data). 2 The medical devices information system only contains personal data where such data are required to record and process information.
Art. 86 Data exchange with other information systems
The medical devices information system may draw the data referred to in Article 85 from the European Database on Medical Devices and from cantonal electronic systems; it may also submit data to Eudamed and cantonal systems.
Art. 86 — Amended by Annex 5 No 1 of the O of 4 May 2022 on In Vitro Diagnostic Medical Devices, in force since 26 May 2022 (AS 2022 291).
Art. 87 Access rights
Swissmedic has access to all data recorded in and processed by the medical devices information system.
Art. 88 Data subjects’ rights and data rectification
1 Data subjects’ rights, particularly the right to information, rectification and deletion of data, are governed by data protection legislation. 2 Swissmedic shall ensure that data that are incorrect or have been processed unlawfully are corrected in or deleted from the medical devices information system. Correction and deletion shall take place as quickly as possible, but no later than 60 days of the data subject making their request.
Art. 89 Data archiving
The personal data specified in Article 85 paragraph 2 must be stored in such a way that it is only possible to identify data subjects for a period of ten years after the last device covered by the declaration of conformity was placed on the market. For implantable devices, this period is extended to 15 years.
Art. 90 Publication of data
Swissmedic may publish the following in the medical devices information system: a. device data, as specified in Part B of Annex VI to EU-MDR; b. information on economic operators and devices, as specified in Part A of Annex VI to EU-MDR; c. the general information specified in Article 35 paragraph 7 EU-MDR governing the assessment, designation and notification of conformity assessment bodies and for the monitoring of designated bodies, and on changes that have a significant impact on such tasks; d. summaries of the annual report on monitoring and on-site assessment activities drawn up in accordance with Article 44 paragraph 12 EU-MDR; e. summaries of safety and clinical performance in accordance with Article 63; f. information on certificates issued under Articles 28 and 42–44; g. field safety notices for users or customers issued in the course of field safety corrective actions in accordance with Article 89 paragraph 8 EU-MDR; h. summaries of the reports on Swissmedic’s activities in
let. a — See the footnote to Art. 4 para. 1 let. f.
Art. 91 Subsequent use of data
Non-personal data may be used for the independent assessment of long-term device safety or performance or of the traceability of implantable devices.
Art. 92 Applicability of the Data Protection Act
All data processing activities carried out in the medical devices information system must comply with the Data Protection Act of 25 September 2020.
Art. 92 — Amended by Annex 2 No II 101 of the Data Protection Ordinance of 31 Aug. 2022, in force since 1 Sept. 2023 (AS 2022 568). SR 235.1
