CIPP/A flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Personal data

Information about an identifiable individual; exact definitions vary, and Hong Kong requires recorded data relating to a living individual while Japan covers identifying living individuals.

Data localization

Requirement that data be stored or processed within a jurisdiction; Asian regimes use it in selected sectors rather than as a uniform blanket rule.

Accountability principle

Organizations remain responsible for personal data transferred to third parties and must ensure comparable protection through contracts, certification, or corporate rules.

Sectoral privacy regulation

Privacy rules limited to specific industries, such as financial or health data, coexisting with general laws in several Asian jurisdictions.

Data protection authority

Independent regulator enforcing privacy law; examples include Singapore PDPC, Hong Kong PCPD, Japan PPC, and India Data Protection Board under DPDP Act.

APEC CBPR System

Voluntary certification for controllers in participating APEC economies, backed by enforcement and recognized as a cross-border transfer safeguard where local law permits.

Privacy Recognition for Processors

APEC certification for processors handling personal data on behalf of certified controllers; demonstrates baseline safeguards without certifying the controller's own notices.

Preventing harm principle

APEC principle focusing on avoiding misuse and harm, with remedies proportional to risk rather than strict consent for every processing activity.

CPEA

APEC Cross-Border Privacy Enforcement Arrangement; lets privacy regulators cooperate and share information on cross-border enforcement matters.

ASEAN MCCs

Model contractual clauses for cross-border data transfers in ASEAN; voluntary contract terms that help demonstrate comparable protection.

PDPA consent obligation

Organization must obtain consent before collecting, using, or disclosing personal data, unless an exception or deemed consent applies; withdrawal must be honored.

Deemed consent by notification

Consent implied where organization notifies purpose and individual does not opt out, for specified purposes subject to PDPA conditions.

Singapore DNC Registry

Registry of Singapore telephone numbers; organizations must check and obtain consent before sending specified telemarketing messages, with clear opt-out.

PDPA breach notification

Notify PDPC within three calendar days if breach affects 500 or more individuals or causes significant harm; notify affected individuals without undue delay.

Transfer limitation obligation

Singapore organization may transfer personal data abroad only if it ensures comparable protection via contract, corporate rules, CBPR, or exception.

PDPA penalty cap

For larger organizations, maximum financial penalty is S$1 million or 10% of Singapore annual turnover, whichever is higher.

PDPO six DPPs

Six data protection principles cover collection, accuracy and retention, use, security, openness, and access/correction for personal data.

Hong Kong personal data

Recorded information relating to a living individual who can be identified, in a form practicable for access or processing.

DPP3 use limitation

Data may be used only for the purpose collected or a directly related purpose unless the data subject gives voluntary consent.

Hong Kong section 33

PDPO provision restricting cross-border transfers; it has not been commenced, so no general statutory transfer ban currently applies.

Hong Kong doxxing offence

2021 amendments criminalize disclosing personal data with intent to cause harm, including harassment, threats, or psychological harm.

Section 43A IT Act

Requires body corporates handling sensitive personal data to use reasonable security practices and pay compensation for negligence causing wrongful loss.

SPDI Rules 2011

Indian rules under IT Act governing sensitive personal data; require consent, purpose limitation, security, grievance officer, and CERT-In breach notification.

Sensitive personal data India

SPDI category includes passwords, financial information, health data, sexual orientation, medical records, and biometric information.

CERT-In directions 2022

Require specified cyber incidents be reported within six hours and logs retained for 180 days, with time synchronized to Indian standard time.

DPDP Act 2023

Separate Indian data protection statute creating consent managers, data principal rights, and a Data Protection Board; implementation is phased.

APPI personal information

Information about a living individual that can identify the person, including names, identifiers, and data easily combined with other information.

Japan cross-border consent

Transfer abroad requires prior consent with destination information unless PPC designates an adequate country or safeguards are in place.

Japan opt-out transfer

Handler may transfer to third parties without consent under opt-out only after notifying PPC and individuals; sensitive data excluded.

Japan breach notification

Reportable leaks, including sensitive data or 1,000+ individuals, require prompt notice to PPC and affected individuals.

Special care-required data

APPI category for sensitive data such as medical history, criminal record, race, creed, or social status; stricter handling applies.

PPC

Japan's Personal Information Protection Commission; issues guidelines, supervises handlers, and can impose orders and penalties.