GDPMD certification consultant in Malaysia
MDA establishment licensingGDPMD (MDA Malaysia)
Get the GDPMD certificate the Medical Device Authority asks for before it issues or renews your establishment licence, with a system your warehouse team can actually run.
What it is
GDPMD, Good Distribution Practice for Medical Devices, is the Malaysian Medical Device Authority (MDA) requirement for establishments that import, distribute, or store medical devices under the Medical Device Act 2012. It sets out a quality management system for the distribution chain: storage and handling conditions including cold chain, traceability and distribution records, complaint handling, field safety corrective actions and recalls, installation and servicing where applicable, control of suppliers and outsourced activities, and staff training. Certification is issued by a Conformity Assessment Body registered with MDA and is a condition of establishment licensing for importers, authorised representatives, and distributors.
Who needs it in Malaysia
- Importers and authorised representatives of foreign manufacturers
- A company bringing medical devices into Malaysia on behalf of an overseas manufacturer must hold an establishment licence from MDA, and GDPMD certification from an MDA-registered CAB is part of that application. Without it the licence is not issued and registered devices cannot legally be placed on the market.
- Distributors and wholesalers supplying hospitals, clinics, and pharmacies
- Companies that buy registered devices from an importer and sell them onward to government hospitals, private hospital groups, clinics, dental practices, and retail pharmacies are distributors under the Act and need their own establishment licence and GDPMD certificate, even if they never import.
- Third-party logistics providers storing or transporting medical devices
- Warehouses and transport companies that hold or move medical devices for a licensed establishment are expected to operate under GDPMD controls. Many principals now write GDPMD certification into their logistics contracts so their own audit does not fail on an outsourced activity.
- Establishments renewing their MDA licence
- The establishment licence and the GDPMD certificate both run on a cycle, and a lapsed or suspended GDPMD certificate blocks the renewal. Companies approaching renewal with a system that was built once for the first audit and never maintained are the most common callers we get.
- Manufacturers that also import or distribute other companies' devices
- A local manufacturer holding ISO 13485 for its own products still needs GDPMD for any importing or distribution activity it carries out for other brands, because MDA licenses each activity separately. The two systems share a lot of procedures and can be run as one.
Our process
Gap analysis against GDPMD and your licensed activities
We confirm which activities you will declare to MDA, whether importing, distributing, storing, installing, or servicing, then assess your premises, procedures, and records against every GDPMD clause that applies and hand over a dated, written action list.
Storage, handling, and cold chain controls
We set up the warehouse controls the auditor will walk through: temperature and humidity mapping and monitoring, segregation of quarantined, returned, and expired stock, pest control, cleanliness, and handling of sterile and temperature-sensitive devices including validated cold chain transport.
Traceability, distribution records, and recall procedure
We build the receiving, stock, and delivery records that let you trace any batch or serial number from the manufacturer to the customer, then write and test the recall and field safety corrective action procedure with a mock recall so the timing is proven, not assumed.
Complaints, mandatory reporting, suppliers, and training
We put in place complaint handling and adverse event reporting to MDA within the required timeframes, supplier and outsourced activity agreements with your principals and logistics providers, and a training programme with competency records for every role that touches devices.
Internal audit, management review, and CAB audit support
After the system has run long enough to generate real records, we conduct the internal audit and management review, then accompany you through the certification audit by the MDA-registered CAB and help you close any findings before the certificate is issued.
Timeline
A single warehouse with existing SOPs, a stable product range, and no cold chain typically reaches GDPMD certification in three to six months, most of which is spent running the system so there are records to audit. Companies with multiple branches, temperature-controlled products, or installation and servicing activities usually need six to nine months. If the establishment licence application is time-critical, tell us the date at the first meeting so we can sequence the CAB audit around it.
What affects the cost
- Number of warehouses, branches, and transport routes in scope
- Whether cold chain or other controlled-temperature storage and transport is involved
- Range of device classes handled and whether installation or servicing is offered
- Whether existing SOPs and records can be adapted or the system is built from scratch
- CAB audit fees, quoted separately by the MDA-registered body you choose
- Whether outsourced storage or logistics must be brought under written control
How BUKTI helps
- BUKTI keeps temperature logs, stock movement records, and delivery notes linked to batch and serial numbers, so a traceability exercise during the CAB audit takes minutes instead of an afternoon.
- Complaints, adverse events, and field safety corrective actions run through BUKTI's CAPA workflow with the MDA reporting deadline visible on every case, so nothing is reported late.
- Training records, supplier agreements, and calibration due dates sit in one place with expiry alerts, which is what keeps the system alive between the certification audit and the surveillance visit.
FAQ
Is GDPMD mandatory in Malaysia?
Yes for importers, authorised representatives, and distributors. Under the Medical Device Act 2012 these establishments must be licensed by MDA, and under the current MDA guidance a GDPMD certificate from an MDA-registered Conformity Assessment Body is required as part of the establishment licence application and renewal.
What is the difference between GDPMD and ISO 13485?
ISO 13485 is the international quality management standard for medical device manufacturers and covers design, production, and post-market activities. GDPMD is a Malaysian regulatory requirement focused on distribution, storage, and handling after the device leaves the manufacturer. Manufacturers typically hold ISO 13485; importers and distributors need GDPMD. A company doing both needs both.
How long is a GDPMD certificate valid?
Under the current MDA guidance the certificate is issued for three years, with surveillance audits by the CAB during that period. The establishment licence itself also runs on a renewal cycle, and MDA expects a valid GDPMD certificate at renewal, so the two calendars need to be managed together.
Does a third-party logistics provider need its own GDPMD certificate?
If the 3PL is only a service provider to a licensed establishment, the licensed establishment remains responsible for the outsourced activity and must control it under its own GDPMD system. In practice many principals require their 3PL to hold GDPMD certification so that control is straightforward to demonstrate. We help either party set this up.
How much does GDPMD certification cost in Malaysia?
Cost depends on the number of sites, whether cold chain is involved, the range of devices and activities, and how much of your current documentation can be reused. CAB audit fees are quoted separately by the body you choose. We give a written, fixed-scope consulting quote after visiting your warehouse.
Can GDPMD share a system with ISO 9001 or ISO 13485?
Yes. Document control, training, supplier evaluation, complaint handling, CAPA, internal audit, and management review are common to all three, so we build one manual and one set of procedures with GDPMD-specific additions for storage, distribution records, and MDA reporting. One integrated audit is cheaper than three separate ones.
Related standards
Where we work
Perlis, Kedah, Penang, Perak, Selangor, Kuala Lumpur, Putrajaya, Negeri Sembilan, Melaka, Johor, Pahang, Terengganu, Kelantan, Sabah, Sarawak, Labuan. ISO consultants in every Malaysian state.
Ask about this standard
MDA licence application or renewal coming up?
Tell us which activities you will declare to MDA and how many sites you run. We will map the shortest route to a GDPMD certificate.