MedTech and HealthTech organisations often operate in an environment where privacy cannot be handled in isolation. Health data, product development, SaaS and cloud services, AI, information security and regulatory requirements increasingly meet in the same product and business decisions.
Sharp Cookie Advisors acts as external Data Protection Officer for technology-intensive and regulated health businesses. We combine senior privacy expertise with practical understanding of digital products, healthcare environments and the commercial requirements faced by both growing companies and established organisations.
Our DPO role is independent under the GDPR. At the same time, the Data Protection Officer needs to understand the business well enough to identify the risks that actually matter and provide advice that works alongside product, technology, information security, quality/regulatory and management.
A Data Protection Officer in a MedTech or HealthTech organisation faces different practical issues from a business where personal data is primarily processed in internal support systems.
Personal data and health data may be an integral part of the product itself. New functionality changes data flows. AI can affect both the purpose of processing and the overall risk profile. Cloud and SaaS architecture determines where data is processed and which parties have access to it. At the same time, healthcare providers, regions and other enterprise customers may impose extensive requirements relating to privacy, security, traceability and documentation.
The DPO function therefore needs to assess data protection in its technical, regulatory and commercial context, without taking over decisions that under the GDPR remain the responsibility of the organisation.
Our external DPO support may include:
The scope is adapted to the organisation’s actual risk profile. A company operating a patient app, a connected medical device and a SaaS platform may, for example, require a different DPO model from an established manufacturer whose new digital functionality changes how personal data is processed.
AI is increasingly becoming an integral part of MedTech and HealthTech products.
From a DPO perspective, it is not enough simply to establish that a function uses AI. Relevant questions include what data is used, why it is used, what output is generated, who relies on that output and how the use affects data subjects.
A new AI function may, for example, require an existing DPIA to be revisited, create new processing activities or purposes, or require changes to information provided to patients and users.
We therefore work close to the actual use cases and data flows.
Where AI-related issues extend beyond the DPO role, our separate specialist support in the EU AI Act, AI governance and legal review of AI functionality prior to launch can be brought in without compromising the independence of the DPO or confusing the DPO role with the organisation’s own product and management decisions.
A Data Protection Officer does not replace the organisation’s regulatory, quality, information security or product functions.
In a MedTech environment, that distinction is particularly important.
The MDR and IVDR, the EU AI Act, NIS2 and other regulatory requirements may apply alongside the GDPR. The role of the DPO is not to assume responsibility for those frameworks, but to identify and monitor the privacy issues and help the organisation understand where they need to be addressed together.
This may arise, for example, when:
We can work alongside existing legal, regulatory, quality, security and product teams while maintaining the independence and reporting lines required for the DPO function.
In product-intensive organisations, privacy needs to be involved early enough to influence decisions without turning every product change into a compliance project.
We help organisations establish proportionate processes for matters such as:
The aim is a DPO function that is close enough to the business to understand the risks, but independent enough to challenge the organisation’s decisions where necessary.
Sharp Cookie Advisors has experience acting as external Data Protection Officer for eHealth businesses through product launches and international scaling.
Our work has included privacy governance around telehealth services, AI functionality, apps and clinical workflows, as well as support as products, partnerships and healthcare customer requirements have developed.
Our Digital Health experience also includes multi-tenant SaaS environments involving patient data, AI-supported functionality for patients and healthcare professionals, and technology and compliance work involving IoT, connected products and medical technology contexts.
We work with both growing technology companies and established organisations and can adapt the DPO model to the organisation’s maturity, risk profile and existing internal specialist functions.
The need for DPO support may change over time.
A growing company may need to establish a professional DPO function ahead of larger healthcare customers, expansion into new markets or increased use of health data.
An established MedTech or HealthTech organisation may instead need:
An external model can also be used during a transition period. Once the organisation establishes an internal DPO function, we can support a structured handover and, where appropriate, continue as an external specialist resource.
Our core external DPO model normally includes onboarding, risk-based prioritisation, ongoing monitoring and advice, reporting, accessibility for the organisation and support with more complex privacy matters.
For MedTech and HealthTech, the model is adapted to factors such as the product organisation, data flows, regulatory interfaces, customer structure and existing legal, regulatory, quality and information security functions.
For our full delivery model, onboarding process and pricing structure, read more about our External Data Protection Officer (DPO) service.
Not automatically simply because the organisation operates in MedTech. The need for a DPO is assessed under the GDPR criteria, including the nature, scope and context of the organisation’s processing activities. Processing of health data and regular or systematic monitoring may make the requirement particularly relevant.
Yes. An effective Data Protection Officer needs to understand and communicate with product, technology, regulatory, quality and security functions. At the same time, the DPO must retain independence and must not make the business decisions that the role is later expected to monitor.
The DPO has an important advisory and monitoring role in relation to DPIAs and can assess the data protection implications of AI use. Other matters, such as the EU AI Act, the MDR or commercial product decisions, may require separate advice outside the DPO role.
Yes. We can establish or maintain the DPO function during a transition period and then carry out a structured handover to an internal Data Protection Officer.
A first step is normally a short discussion about the organisation, the product, the processing of personal data and how privacy is currently managed.
We can then assess whether an external DPO model is appropriate and what level of support would be proportionate to the organisation.
