Do the Periodic Safety Update Report (PSUR) and Summary of Safety and Performance requirements (SSP) have to be generated by individual device or can they be generated by device family under MDR?

This will need to be considered on a case-by-case basis. With
regards to SSP, Article 32 indicates that the Device Identifier
is included in the SSP. With regards to PSUR, the wording in
Article 86 allows PSUR to be prepared per device and where
relevant per category or group of devices. If such grouping
were to occur, Notified Bodies expect that the rationale behind
grouping the devices is clearly documented.