GDPMD certification without the drama.

GDPMD meaning

GDPMD stands for Good Distribution Practice for Medical Devices. It is the quality-management standard that every medical device importer, distributor and authorized representative in Malaysia must be certified against. The certificate is issued by an MDA-registered Conformity Assessment Body (CAB), and MDA relies on it before granting the establishment licence those companies need to trade.

The license behind the license

GDPMD is Malaysia’s quality-system requirement for the distribution side of the device industry. Without a valid GDPMD certificate from a registered CAB, MDA will not grant — or renew — the establishment license an importer, distributor or authorized representative needs to operate. In practice it covers the disciplines regulators care about most: supplier and customer traceability, storage and transport controls, installation and servicing records, complaint handling, and recall readiness.

Our GDPMD practice has run since 2016 under AA Alive Sdn Bhd. We write the system around how your operation actually works — a wholesaler with one warehouse should not carry the paperwork of a multi-site cold-chain operation.

“GDPMD licence” or GDPMD certificate?

Worth settling early, because the wrong word sends companies to the wrong authority. GDPMD is a certificate, issued by a Conformity Assessment Body — a private, MDA-registered auditing organisation. It is not issued by the MDA. What most people mean when they search for a “GDPMD licence in Malaysia” is the MDA establishment licence: the government permission to operate as an importer, distributor or authorized representative.

You need both, in that order. The CAB certifies your quality system; MDA then licenses your establishment on the strength of that certificate. They also renew on different clocks — follow the CAB certificate and surveillance schedule for GDPMD, and renew the establishment licence every three years — which is precisely where companies lose their licence without meaning to. A GDPMD certificate that lapses in month 14 quietly undermines a licence that still has two years to run.

New for 2026: GDPMD is now upstream of every tender.

Under Circular Letter No. 1/2026, in force since 28 January 2026, every tenderer must hold a valid MDA establishment licence before participating in any new medical device tender — non-compliance is an offence under Section 15 of Act 737. Since GDPMD certification is a condition of that licence, the chain now runs: GDPMD certificate → establishment licence → eligibility to bid.

For anyone whose pipeline includes hospital or government supply, that reorders the calendar. Certification is a months-long exercise that produces real operating records — it cannot be compressed into the window between a tender advertisement and its closing date. (Verified against the official MDA portal, 10 August 2026 — the full dated digest of 2026 MDA changes is on our sister site, iso13485.my.)

Which role are you certifying?

GDPMD follows the role you play in the supply chain, not the kind of device you handle. Most companies hold more than one role, and one certificate can cover them all if the scope is drawn properly at the start — getting that scope wrong is the most expensive avoidable mistake on this page.

• Importer — brings devices into Malaysia; needs GDPMD covering goods-in verification, storage and onward traceability
• Distributor / wholesaler — supplies onward to hospitals, clinics or dealers; needs delivery, returns and recall controls
• Authorized representative — holds registrations for a foreign manufacturer; needs GDPMD plus the vigilance and duty-holder obligations of Act 737
• Servicing and installation providers — where devices are installed, calibrated or maintained, those records fall inside the scope (see GDPMD paragraph 28)
• Manufacturers — implement ISO 13485 instead; see ISO 13485 vs GDPMD if you do both

What the CAB audit actually looks at

The certification audit runs in two stages. Stage 1 is a documentation review: does a quality system exist on paper, and does its scope match what you actually do? Stage 2 is on-site, and it is where certification is won or lost — the auditor tests whether the documented system is genuinely running.

Expect them to follow real transactions end to end: a specific device from goods-in through storage, picking, delivery and, where applicable, installation or servicing — checking at each step that the records exist, agree with each other, and were written when the work happened rather than the week before the audit. A mock recall is a common test, because it exercises traceability in both directions at once.

Findings cluster in predictable places, and almost never in the quality manual itself: procedures written but never followed, temperature and storage logs with unexplained gaps, no evidence that management review or internal audit ever took place, supplier evaluation missing for a live supplier, traceability that breaks the moment a mock recall crosses a batch split. That pattern is the reason our engagement runs the system long enough to generate genuine records — then internal-audits it the way the CAB will, before the CAB does.

Certification is not the end of the audit relationship. Surveillance audits follow the CAB surveillance schedule and check the same thing: that the system is still being used.

Build an evidence pack before the CAB audit

Use actual operating records and protect personal and commercially sensitive information. These are preparation examples; the CAB sets the assessment scope for your establishment.

Engagement path

1. Gap analysis — on-site or remote review of your current operation against GDPMD requirements; you receive a findings report and a fixed package quote.
2. System build — quality manual, SOPs, forms and records tailored to your operation, with your team trained on each procedure.
3. Implementation & internal audit — the system runs long enough to generate real records; we internal-audit it the way the CAB will.
4. CAB certification audit — we manage the audit, sit in the room (or on the call), and close any findings.
5. Licence & renewal — the certificate feeds the establishment licence submission, and we carry the renewal calendar from there.

Fees — our fee, and the CAB fee you pay direct

Foreign manufacturer? The same RM5,500 fee covers GDPMD and the authorised representative, importer and distributor licence submissions; each role's MDA licence fee is paid direct to MDA — see AR services and pricing.