CIPP/A key terms

A single statute governing how personal data is processed across the private sector generally, rather than through industry-specific rules; Singapore's PDPA and Japan's APPI are examples.

A regulatory approach that imposes privacy duties on particular industries or data types - for example, finance, health or telecommunications - leaving other processing largely unregulated unless a general law also applies.

An independent or semi-independent body established by statute to enforce data protection law, issue guidance, handle complaints and impose sanctions; examples are Singapore's PDPC, Hong Kong's PCPD and Japan's PPC.

A requirement that specified data be stored or processed on equipment physically located within a jurisdiction, sometimes paired with a prohibition on offshore transfer; it appears in Asian sectoral rules rather than as a blanket ban.

A legal limit on sending personal data out of a jurisdiction, usually conditioned on consent, contract, an adequacy finding or a statutory whitelist; Singapore, Hong Kong, Japan and India each structure the condition differently.

A non-binding framework agreed in APEC, first issued in 2004 and revised in 2015, containing nine information privacy principles meant to harmonise protection across member economies without obstructing trade.

A voluntary certification scheme in which an organisation's privacy practices are assessed against the APEC Framework by an approved Accountability Agent, enabling easier data flows between participating economies.

An APEC certification for organisations that process data on behalf of others, showing controllers in participating economies that the processor meets recognised privacy standards.

An independent body approved by an APEC economy that assesses organisations seeking CBPR or PRP certification, monitors their compliance and handles complaints about certified organisations.

The nine principles at the heart of the APEC Framework: preventing harm, notice, collection limitation, uses of personal information, choice, integrity, security safeguards, access and correction, and accountability.

Singapore's 2012 statute regulating collection, use and disclosure of personal data by private organisations; it created the Do Not Call regime and the PDPC, and was substantially amended in 2020.

Singapore's regulator for the PDPA, a unit of the Infocomm Media Development Authority, which issues advisory guidelines, investigates breaches and can impose financial penalties on organisations.

The Singapore registry of telephone numbers whose owners have opted out of telemarketing; sending specified messages to a registered number without clear consent is a breach of the PDPA.

A PDPA concept where consent is inferred without an express statement - through conduct in providing data, contractual necessity, or notification with an easy opt-out - rather than being positively given.

A PDPA exception permitting processing without consent where an organisation has a legitimate interest that outweighs likely harm, subject to documented assessment and an obligation to inform individuals.

A person appointed by an organisation to oversee PDPA compliance, whose business contact details must be made public, and to whom data protection queries and complaints are directed.

The PDPA duty, effective from 1 February 2021, to notify the PDPC within three calendar days of determining that a breach is notifiable, and affected individuals where significant harm is likely.

Hong Kong's Personal Data (Privacy) Ordinance, in force since 1995, which applies to personal data held by public and private organisations and sets six Data Protection Principles plus marketing and access rules.

The six core obligations in Hong Kong's PDPO: lawful and fair collection with minimal data, accuracy and retention limits, purpose limitation, security, openness, and access and correction rights.

Hong Kong's independent statutory office that promotes and enforces the PDPO, publishes codes of practice and guidance, and investigates complaints about data users.

A request by a data subject in Hong Kong for a copy of personal data held about them; the data user must comply within 40 days unless a statutory exemption applies.

Part 6A of the PDPO requires written consent and a response facility before personal data is used or supplied for direct marketing, with criminal liability for non-compliance.

The never-implemented PDPO provision that would require Hong Kong data users to ensure offshore transfers receive protection comparable to the Ordinance, or fall within a specified exemption.

The 2021 amendments that created offences for disclosing personal data without consent intending to cause harm, and gave the Commissioner powers to demand cessation and investigate doxxing.

India's 2023 statute for digital personal data, replacing the SPDI Rules framework; it sets obligations for Data Fiduciaries, rights for Data Principals and establishes the Data Protection Board.

Under the DPDP Act 2023, the person that determines the purpose and means of processing digital personal data, and carries duties of notice, consent, security and breach reporting.

The DPDP Act 2023 term for the individual whose digital personal data is processed, holding rights of access, correction, erasure and grievance redress; for children, a parent or guardian acts.

A Data Fiduciary designated by the Indian government based on data volume, sensitivity and risk, attracting extra duties such as an India-based data protection officer, audits and impact assessments.

The adjudicating body created by the DPDP Act 2023, which hears complaints, orders remedial action and imposes financial penalties for breaches of the Act.

Indian rules under section 43A of the IT Act governing sensitive personal data such as passwords, financial information and health data; they were largely superseded by the DPDP Act 2023.

An Indian IT Act provision making a body corporate liable to compensate affected persons for negligent failure to maintain reasonable security practices for sensitive personal data, now repealed by the DPDP Act.

A person registered with India's Data Protection Board who acts as a single point for a Data Principal to give, manage, review and withdraw consent across different Data Fiduciaries.

Japan's statute governing business handling of personal information; it defines special categories, regulates third-party provision and cross-border transfer, and is supervised by the Personal Information Protection Commission.

Japan's independent administrative commission that oversees APPI compliance, issues guidelines, handles complaints, and may issue recommendations and orders to businesses.

The APPI category for sensitive data such as race, creed, social status, medical history, criminal record and disability, which generally requires explicit consent and extra safeguards.

An APPI concept covering identifiers like passport numbers, biometric templates and My Number that single out an individual, treated as personal information even without a name.

An APPI route allowing data to be supplied to third parties without consent where the business notifies the PPC and the individual in advance and provides an easy opt-out; sensitive data is excluded.

Information produced by processing personal data so that specific individuals cannot be identified unless matched with other data; the APPI relaxes some rules but restricts third-party provision.

Japan's rules on transfers to foreign third parties: prior consent is generally required unless the destination is on the PPC's adequate list or the recipient maintains equivalent standards, such as APEC CBPR certification.