GDPMD Certification Malaysia: Who Needs It and Steps

GDPMD Certification in Malaysia: Who Needs It and the Path to an MDA Establishment Licence

GDPMD certification in Malaysia is the quality system certificate that authorised representatives, importers and distributors of medical devices must hold before they apply for an establishment licence from the Medical Device Authority (MDA). Manufacturers follow a different route and need ISO 13485 instead, so the choice between ISO 13485 and GDPMD certification depends on your role. This guide shows which certificate fits which role, how GDPMD differs from ISO 13485, and the order of steps from the audit to the licence application.

What Is GDPMD Certification in Malaysia?

GDPMD stands for Good Distribution Practice for Medical Devices. It is an MDA regulatory document, MDA/RR No 1 (first revision, November 2015), made under the Third Schedule of the Medical Device Regulations 2012. It sets the quality system an establishment must run for sourcing, storage, delivery, traceability, complaints and recalls, so that devices keep their safety and performance until they reach the user. As of October 2026, MDA's guidance list still shows that revision as current.

A Conformity Assessment Body (CAB) audits your system against the document and issues the certificate. The document itself says certification does not prove compliance with any written law. You still answer to the Medical Device Act 2012 (Act 737) and its regulations.

Who Needs GDPMD Certification in Malaysia?

MDA's FAQ says the GDPMD requirement applies to "the AR, importer and distributor", citing paragraph 11 of the Third Schedule of the Medical Device Regulations 2012. The table below puts each role next to the certificate MDA names for it.

Outsourcing does not remove your duty. Under MDA's licensing guidance, a warehouse or transport provider you appoint may seek its own GDPMD certificate but need not apply for an establishment licence. As distributor you stay in control through procedures and written agreements, name those partners in your quality manual, and audit each provider as part of your own system unless it already holds GDPMD covering that activity.

Medical devices are one of the Malaysian industries that require ISO certification in some form, and your role decides which certificate applies.

GDPMD vs ISO 13485: Which Certificate Does Your Business Need?

Your role decides, not the size of your business. ISO 13485 is the global quality system standard written for organisations working with medical devices. MDA's licensing guidance (MDA/GD/0027, second edition) names MS ISO 13485:2017 or ISO 13485:2016 for manufacturers. The ISO catalogue entry for ISO 13485:2016 says it was last reviewed and confirmed in 2025, so it remains current.

For an AR, importer or distributor, the same guidance says the quality system must be based on GDPMD. MDA states the requirement by role, so an ISO 13485 certificate does not stand in for GDPMD on a distribution licence. A manufacturer that also distributes other makers' devices needs a separate distributor licence for that activity.

Many distributors already hold ISO 9001 certification. It builds useful habits such as document control and internal audits, but MDA's licensing guidance does not name ISO 9001 for any licence type. If you are building from scratch, a quality management system that covers the core ISO 9001 requirements gives you a familiar skeleton to adapt.

Why Is GDPMD Certification Required for an MDA Establishment Licence?

Section 15(1) of Act 737 bars any establishment from importing, exporting or placing a registered medical device in the market without an establishment licence. Section 15(2) sets the penalty for breaking that rule at a fine of up to RM200,000, imprisonment of up to three years, or both.

The licence application then needs proof of your quality system. MDA's FAQ says GDPMD is assessed and certified by the CAB, and the CAB certificate goes in with the application. MDA licenses four types of establishment: manufacturer, AR, importer and distributor. Under its single licence policy (General Order No. 1 of 2024, effective 1 July 2024), each role needs its own licence, so a company acting as AR and distributor applies for both.

What Does GDPMD Cover?

MDA/RR No 1 groups its requirements into five areas.

1. Organisation and regulatory compliance system: an organisation chart, job descriptions, a regulatory compliance manual, document control and records.
2. Establishment responsibilities: a designated person who reports to top management, plus management review.
3. Resource management: trained staff, suitable premises, work environment, cleanliness and pest control.
4. Supply-chain and device-specific controls: authorisation, receiving and storing stock, stock rotation, delivery, returned and nonconforming devices, disposal, traceability, outsourced activities, counterfeit or tampered devices and secondary assembly such as repackaging.
5. Surveillance and vigilance: complaints, distribution records, field corrective action, recall, mandatory problem reporting and internal audits.

Several of these will be familiar if you have run a quality system before. Written procedures only help if staff follow them, and the usual causes of poor SOP compliance apply to distribution procedures too. GDPMD asks for documented corrective and preventive action, the same discipline as CAPA in an ISO quality system, and returned stock needs a clear non-conformance report routine.

Your certificate also has a defined scope. MDA's GDPMD document lists the activities a certificate can cover, such as import, storage and handling, warehousing, distribution including transport, installation, maintenance and calibration. It also records the device categories you deal with. MDA's FAQ adds that a certificate scoped to dental devices cannot support registering an implantable device, so choose the scope to match your product range.

What Are the Steps to Get GDPMD Certification in Malaysia?

The order below follows MDA's licensing guidance. If you know how to get ISO certification in Malaysia, the order will look familiar, but the CAB and the licence are specific to MDA.

1. Confirm that your products are medical devices under Act 737 and decide which establishment role or roles you hold.
2. Build and run a quality system based on GDPMD: compliance manual, procedures, records, a designated person, staff training, an internal audit and a management review.
3. Appoint a CAB registered under section 10 of Act 737. MDA links a list of registered CABs from its establishment licence information page, but confirm the CAB's current MDA registration and scope with MDA before you appoint it.
4. Complete the CAB audit and fix any findings. The CAB issues a conformity assessment report and a certificate.
5. Create a MeDC@St 2.0+ account and apply for each licence online, uploading the CAB report and certificate. Only the primary account user can submit.
6. If your CAB has issued a provisional certificate, you may apply with it. MDA's FAQ says you must update MDA once the full certificate arrives.
7. Download the licence from MeDC@St 2.0+. For applications approved after 15 April 2026, MDA issues only the electronic licence.

Plan the audit date around your licence need. The application cannot go in until you hold at least a provisional certificate, so a late audit delays everything after it.

Choose the CAB carefully. MDA's FAQ says an ISO 13485 audit report from a foreign notified body was not accepted, because the CAB must be a local body registered under section 10. Timelines and audit fees differ by CAB and by the size of your operation, so ask each one for a written audit plan and quote. MDA sets licence fees under the Medical Device Regulations 2012, so confirm the current amounts with its licensing unit.

Renewal is a separate application. MDA's licensing guidance and its establishment licence conditions both ask you to apply at least 90 days before the licence expires. Section 24 of the Act also sets a renewal window and is worded differently, so confirm your deadline with the MDA licensing unit. Your GDPMD certificate carries its own validity and expiry dates, which the CAB must show on it.

What Should You Prepare Before the CAB Audit?

Auditors check whether your documents match daily practice, so gather evidence for the points MDA/RR No 1 spells out. Traceability comes first. You must be able to trace each device by make, model, batch or serial number and quantity, as appropriate, from the manufacturer or importer to the customer. Keep those records for the longest of three periods: the one set by regulation, the device's lifetime as defined by its manufacturer, or two years from shipment.

Returned stock is the second check. The document says a returned device must be handled as a nonconforming device, under a documented procedure, with records of what was wrong and what you did about it. If you deal in implants, MDA requires a tracking record for all implants down to patient level, especially high-risk types such as pacemakers and mechanical heart valves. Facility-level tracking applies only where patient tracking is not possible, for example without patient consent. You must also send MDA surveillance reports on the high-risk types at least once a year.

Active medical devices add a third check. Your installation, testing, commissioning and maintenance procedures must follow MS 2058, the Malaysian code of practice for good engineering maintenance of active medical devices, and your test equipment must be calibrated or verified at set intervals. Finally, importers and distributors must be authorised by the AR or manufacturer of each registered device, so keep your letters of authorisation current and to hand.

If you are getting ready for an MDA establishment licence, contact Connext to discuss an ISO 13485 and GDPMD gap analysis, documentation preparation and internal audits. We do not issue certificates, and no consultant can promise a licence or audit result.

Frequently Asked Questions

Is GDPMD certification mandatory in Malaysia?

Yes, for authorised representatives, importers and distributors applying for an MDA establishment licence. MDA's FAQ describes GDPMD as the quality system requirement for these roles, and the CAB certificate is submitted with the application. Manufacturers need ISO 13485 instead of GDPMD.

Can I apply for the establishment licence on a provisional GDPMD certificate?

Yes. MDA's FAQ says an establishment can apply once it holds a provisional certificate from the CAB. You then need to update MDA when the full certificate is issued. Check with your CAB how and when the provisional certificate converts.

Can an ISO 13485 certificate replace GDPMD for a distributor?

No. MDA names ISO 13485 for manufacturers and a GDPMD-based quality system for authorised representatives, importers and distributors. A distributor that holds only ISO 13485 should assume it still needs a GDPMD certificate from a registered CAB before applying for a licence.

Does MDA accept an overseas body's audit for GDPMD or ISO 13485 certification?

Not according to its FAQ. MDA rejected an ISO 13485 audit report from a foreign notified body because recognition must come from a local CAB registered under section 10 of Act 737. Confirm any CAB's current MDA registration and scope with MDA before appointing it.

Do retailers need GDPMD certification?

Retailers are outside the scope of the GDPMD document. MDA's licensing guidance adds that a retailer who imports, exports or distributes must hold the establishment licence matching that activity. Ask MDA how the quality system requirement applies to your exact activities.