CIPP/A cheat sheet

Asia has no single binding regional privacy treaty; regulation is national or territorial, often combining omnibus statutes with sectoral rules and voluntary frameworks such as APEC.

Recurring statutory elements include notice and purpose specification, a lawful basis such as consent, use limitation, security safeguards, retention limits, access and correction rights, and accountability.

Legal structures differ: Hong Kong uses six data protection principles; Singapore and Japan rely on omnibus statutes plus regulator guidance; India retains the IT Act and SPDI Rules alongside the DPDP Act 2023.

Data localization is not uniform; selected sectors impose local storage or processing, while most regimes regulate transfers through consent, contract, adequacy, or accountability conditions.

Regulator models vary: Singapore PDPC, Hong Kong PCPD, Japan PPC, and India Data Protection Board under the DPDP Act; enforcement tools include directions, financial penalties, and criminal offences.

The definition of personal data differs: Hong Kong requires recorded data relating to a living individual; Japan covers information identifying a living individual; Singapore covers data about an identifiable individual.

Cross-border transfer restrictions commonly use adequacy, consent, contractual clauses, binding corporate rules, or certification such as APEC CBPR; ASEAN MCCs are another contractual tool.

Breach notification is not universally identical: Singapore and Japan have specific mandatory regimes; Hong Kong generally relies on guidance; India has CERT-In and sectoral rules plus DPDP Act provisions.

The APEC Privacy Framework, adopted in 2004 and updated in 2015, contains nine principles: preventing harm, notice, collection limitation, uses of personal information, choice, integrity, security safeguards, access and correction, and accountability.

The APEC CBPR System is a voluntary, government-backed certification for controllers in participating economies; certified organizations must have enforceable privacy policies and complaint-resolution mechanisms.

The Privacy Recognition for Processors certifies processors that handle personal information on behalf of CBPR-certified controllers; it addresses processor safeguards rather than controller notices.

CBPR participation requires an economy-level authority, an accountability agent, and enforcement cooperation; certification can serve as a transfer safeguard where local law recognizes it.

The APEC Cross-Border Privacy Enforcement Arrangement allows privacy regulators to share information and cooperate on cross-border enforcement matters.

The APEC framework is not a binding treaty; its preventing-harm approach is risk-based and permits remedies proportional to the likelihood and severity of harm.

ASEAN Model Contractual Clauses provide voluntary contract terms for cross-border data flows and can help demonstrate comparable protection in the absence of an adequacy finding.

Decision rule: when transferring to a non-adequate economy without a consent or legal exception, a controller may use CBPR certification, processor certification, contractual clauses, or binding corporate rules where the destination law recognizes the mechanism.

The PDPA applies to organizations handling personal data in Singapore; public agencies, individuals acting in a personal or domestic capacity, and business contact information are excluded from key obligations.

Organizations must obtain consent before collecting, using, or disclosing personal data unless an exception or deemed consent applies; withdrawal of consent must be honored and processing must stop.

Deemed consent by notification can apply to specified purposes where the organization notifies the individual and the purpose is not likely to have an adverse effect.

Core obligations include purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation, openness, appointment of a data protection officer, and breach notification.

Data breach notification to the PDPC is required within three calendar days where the breach affects 500 or more individuals or causes or is likely to cause significant harm; affected individuals must be notified without undue delay.

The Do Not Call Registry requires organizations to check Singapore telephone numbers and obtain consent before sending specified telemarketing messages, with clear opt-out mechanisms.

The transfer limitation obligation permits overseas transfer only where the organization ensures a comparable standard of protection through contractual clauses, binding corporate rules, CBPR certification, or an exception.

Financial penalties can reach the higher of S$1 million or 10% of annual Singapore turnover for organizations with turnover exceeding S$10 million; other organizations face up to S$1 million.

The PDPO applies to data users processing personal data, defined as recorded information relating to a living individual who can be identified, in a form practicable for access or processing.

The six data protection principles cover collection; accuracy and retention; use; security; openness; and access and correction.

DPP1 requires collection for a lawful purpose and by fair means, with collection adequate but not excessive for the purpose.

DPP3 use limitation permits use only for the original purpose or a directly related purpose unless the data subject gives voluntary and informed consent.

Section 33 of the PDPO would restrict cross-border transfers, but it has not been commenced; PCPD guidance recommends contracts, due diligence, and risk assessment rather than imposing a general statutory ban.

Part VIA regulates direct marketing and requires specified consent, opt-out facilities, and provision of prescribed information; contravention can be a criminal offence.

There is no general mandatory breach notification requirement; PCPD guidance recommends notifying affected individuals and the Commissioner where a breach is likely to cause harm.

The 2021 anti-doxxing amendments criminalize disclosing personal data with intent to cause harm, including harassment, threats, or psychological harm; the PCPD has enforcement powers.

Section 43A of the IT Act requires a body corporate handling sensitive personal data to implement reasonable security practices and procedures and pay compensation for negligence causing wrongful loss.

The SPDI Rules 2011 define sensitive personal data and require consent, purpose limitation, retention limits, reasonable security, a grievance officer, and notification of security breaches to CERT-In.

Sensitive personal data under the SPDI Rules includes passwords, financial information, health data, sexual orientation, medical records, and biometric information.

Section 72A of the IT Act creates a criminal offence for disclosing personal information in breach of a lawful contract with intent to cause wrongful gain or loss.

CERT-In Directions 2022 require specified cyber incidents to be reported within six hours, logs to be retained for 180 days, and time synchronization to Indian Standard Time.

The Intermediary Guidelines 2021 impose due diligence, grievance officer, data retention, and takedown obligations on intermediaries.

The DPDP Act 2023 is a separate statute creating consent managers, data principal rights, and a Data Protection Board; implementation is phased and IT Act rules remain relevant during the transition.

Sectoral regulators such as the RBI and SEBI impose additional security, breach notification, and localization requirements on regulated entities.

The APPI applies to personal information handlers and covers personal information, personal data in a database, retained personal data, and pseudonymized information.

Handlers must specify the purpose of use, notify or announce it, and not exceed that purpose without consent or another lawful basis.

Third-party provision requires prior consent except where the opt-out procedure applies; opt-out requires notification to the PPC and individuals and is unavailable for special care-required personal information.

Cross-border transfer requires prior consent with destination information unless the PPC designates the destination as adequate or the recipient maintains equivalent safeguards.

The 2022 amendments introduced rules for individual-related information such as cookies and location data, pseudonymized information, and stricter third-party provision records.

Reportable data breaches, including leaks of sensitive data, leaks affecting 1,000 or more individuals, or leaks with misuse risk, require prompt notification to the PPC and affected individuals.

Special care-required personal information includes data such as medical history, criminal record, race, creed, and social status; stricter handling and consent rules apply.

The Personal Information Protection Commission issues guidelines, supervises handlers, and can impose orders and penalties, including criminal penalties for unlawful provision of personal data.