---
kind: "section"
citation: "21 C.F.R. § 820.35"
title: "21"
number: "820.35"
heading: "Control of records."
url: "https://uscodex.org/cfr/21/820.35"
---

# §820.35. Control of records.


In addition to the requirements of Clause 4.2.5 in ISO 13485 (incorporated by reference, see [§ 820.7](/cfr/21/820.7.md)), Control of Records, the manufacturer must include the following information in certain records:

- (a) **Records of complaints.** In addition to Clause 8.2.2 in ISO 13485, Complaint Handling, the manufacturer shall maintain records of the review, evaluation, and investigation for any complaints involving the possible failure of a device, labeling, or packaging to meet any of its specifications. If an investigation has already been performed for a similar complaint, another investigation is not necessary, and the manufacturer shall maintain records documenting justification for not performing such investigation. For complaints that must be reported to FDA under [part 803](/cfr/21/part803.md) of this chapter, complaints that a manufacturer determines must be investigated, and complaints that the manufacturer investigated regardless of those requirements, the manufacturer must record the following information:
  - (1) The name of the device;
  - (2) The date the complaint was received;
  - (3) Any unique device identifier (UDI) or universal product code (UPC), and any other device identification(s);
  - (4) The name, address, and phone number of the complainant;
  - (5) The nature and details of the complaint;
  - (6) Any correction or corrective action taken; and
  - (7) **Any reply to the complainant.**
- (b) **Records of servicing activities.** In adhering to Clause 7.5.4 in ISO 13485, Servicing Activities, the manufacturer must record the following information, at a minimum, for servicing activities:
  - (1) The name of the device serviced;
  - (2) Any UDI or UPC, and any other device identification(s);
  - (3) The date of service;
  - (4) The individual(s) who serviced the device;
  - (5) The service performed; and
  - (6) **Any test and inspection data.**
- (c) **Unique Device Identification.** In addition to the requirements of Clauses 7.5.1, 7.5.8, and 7.5.9 in ISO 13485, the UDI must be recorded for each medical device or batch of medical devices.
- (d) **Confidentiality.** Records deemed confidential by the manufacturer may be marked to aid FDA in determining whether information may be disclosed under the public information regulation in [part 20](/cfr/21/part20.md) of this chapter.

## Notes

### Authority

Authority: 21 U.S.C. 351, 352, 360, 360c, 360d, 360e, 360h, 360i, 360j, 360l, 371, 374, 381, 383; 42 U.S.C. 216, 262, 263a, 264.

### Source

Source: 89 FR 7523, Feb. 2, 2024, unless otherwise noted.