ASIFMA JURISDICTIONAL COMPARISON OF DATA PROTECTION RULES
A comparison of key data protection regulation across APAC jurisdictions
JULY 2020

Developed in kind collaboration with:

EU / UK
1...

General data
privacy andprotection rules
and regulator(General andcurrent laws
governing personal
data or critical
data etc., including
requirements forstandalone servers
and mirroring.
Excludes specificrules regarding
cloud/virtual data
storage which isout of scope)

APEC Privacy
Framework and theASEAN Framework

The General Data
The APEC Privacy
Protection Regulation (the Framework is"GDPR")
available here.
The ASEAN
Framework on
Personal Data
Protection is available
here.

China

India

Hong Kong

The Cyber Security Law of thePeople’s Republic of China (the“PRC”) (the “CSL”) released by theStanding Committee of the
National People's Congress andcame into force in 20171, and its
implementation regulations andmeasures released by various
regulators including but not limited
to Cyberspace Administration ofChina and Ministry of Public
Security.

Currently, the regulations
relating to personal dataprotection in India arecontained in the
Information Technology
Act 2000 (as amended)(“IT Act”); and theInformation Technology(Reasonable Security
Practices and Procedures
and Sensitive Personal
Data or Information)
Rules 2011 was issued
thereunder (“SPDI
Rules”).

Personal Data (Privacy)
Ordinance (Cap. 486)
(the "PDPO"). [andsupplementary
regulations issued
thereunder].

The General Principles of the Civil
Law of the PRC released by the
National People's Congress(“NPC”) came into force in 20172,
which provides a right to personal
data protection.
The PRC Criminal Law released by
the NPC came into force in 20173,
criminalizing the intrusion of
information systems and othercybercrimes, which have beenrelied upon in prosecuting
personal data protection
infringements.

Existing

The Decision on Strengthening theProtection of Online Information
released by the Standing
Committee of the NPC came into
force in 20124, which provides
certain general principles on theprotection of citizen’s online
information.
The Measures on the Protection of
Personal Data of
Telecommunication and Internet
Users released by the Ministry ofIndustry and Information
Technology (the “MIIT”) came into
force in 20135, which provide
relevant rules on the protection ofusers’ personal data.

At present, there is no
designated authority fordata privacy matters;
however, contraventions of
the IT Act and rules madethereunder dealt with by
adjudicating officers, andthe cyber appellate tribunal
constituted under the IT Act.
The PDP Bill (see Row 3
below) would establish a
Data Protection Authority(the “DPA”).

Singapore
The Personal Data
Protection Act 2012
(the “PDPA”) andsupplementary
regulations issued
thereunder.

The PDPO is administered The PDPA is administeredand enforced by the Office and enforced by theof the Privacy
Personal Data Protection
Commissioner for Personal Commission (“PDPC”).
Data (the“Commissioner”)
The PDPC also issued anumber of advisory
The Commissioner also
guidelines.
issued a number of codesof practice and guidelines.

Malaysia
The Personal Data
Protection Act (the“PDPA”) and related
subsidiary legislation
issued thereunder.
The PDPA is administeredand enforced by the
Personal Data Protection
Commissioner (the“Commissioner”).

ThailandThe Personal Data
Protection Act (the“PDPA”) andsupplementary
regulations issued
thereunder.

Indonesia
There is no general law
on personal dataprotection. The key
regulations which apply
to general personal data
privacy are as follows:

The PDPA is administeredand enforced by the
Personal Data Protection
Commission (“PDPC”); andthe Office of Personal Data
The Commissioner also
Protection Commission
issued a number of codes of (“PDPC’s Office”), a
practice and FAQs.
government agency topromote and support thedevelopment of personal
data protection.

1. Law No. 11 of 2008 on
Electronic Information
and Transactions, as
amended by Law No. 19
of 2016 (“EIT Law”);
2. Government Regulation
No. 71 of 2019 on
Administration ofElectronic System andTransaction (“GR 71”);
and3. Minister ofProvisions under Chapters 2,
Communication and3, 5, 6, 7, Sections 95, andInformatics Regulation
Section 96 of the PDPA will
No. 20 of 2016 on the
become effective on 27 May
Protection of Personal
2020.
Data in Electronic
Systems (“Regulation
20”)
In addition to the above
regulations, sectoral
legislation may apply.

Philippines
The privacy and dataprotection in thePhilippines is governed by
the Data Privacy Act of2012 (DPA) or Republic
Act 10173, which
provides comprehensive
protections for personal
information. It is
supported by the
Implementing Rules andRegulations of the Data
Privacy Act of 2012.

VietnamJapan

Vietnam does not have a
Personal Information
comprehensive legislative Protection Act (PIPA)
regime or regulatory
Japanese amended law
body responsible for
was fully effective as of 30
privacy. There are varied
May 2017. In Japan,
requirements relating to the privacy is regulated by theprotection of personal
Act on the Protection of
information across a
Personal Information
number of laws.
(‘APPI’).

The Law on Network
The APPI is aInformation Security
comprehensive privacy law(86/2015/QH13) (‘NIS Law’), administered by thealso widely referenced as
Personal Information
The National Privacy
the Law on Cybersecurity,
Protection Commission
Commission is theestablishes the most(‘PPC’); it applies toindependent body tasked
comprehensive
personal information
to administer andrequirements andhandling business
implement the provisions
definitions regarding theoperators (‘PIHBO’) toof the Act.
protection of personal
protect the interests of
information. These
principals. The PPC issued
In comparison to its
requirements apply to
an interim draft report,neighbours, the Philippines individuals andwhich revealed plans forhas one of the stronger
organizations engaged inJapan to revise its existing
privacy regimes in the Asia information technology
personal information
Pacific region. With a rapidly application andprotection law in 2020.
growing IT, digital economy, development activities.
The focus will be toand social media users, the There are a number of laws introduce a right to be
Government and privacy
and regulations that apply to forgotten, which would be
regulator has a mandate to certain sectors and types
applied cross Japan’s
protect the privacy ofof transactions, such as the borders.
individuals and ensure the Law on Protection offree flow of information.
Consumers’ Rights, the Law
on Information Technology
and the Decree on
E-Commerce, which may
apply to personal
information.

TaiwanAustralia

New Zealand

In Taiwan, personal
information isprotected under the
Personal Information
Protection Act (PIPA)(sometimes referred to
as PDPA), which isenforced by industry
regulators and local
government
authorities.

The general national
privacy law inAustralia is thePrivacy Act 1988,
supported by otherlegislation such as thePrivacy Regulation2013, the Spam Act
2003 and various
state acts that deal
with sectoral privacy,
such as privacy in theworkplace and healthinformation privacy.

The Privacy Act 1993
controls how 'agencies'
collect, use, disclose,
store, and give accessto personal
information.

The legislation wasenacted in 1995 andamended in 2010 and2015. When drafted, the
PIPA considered theEuropean Data
Protection Directive(Directive 95/46/EC). In
2018, Taiwan was
admitted to the AsiaPacific Economic
Forum’s Cross Border
Privacy Rules system,
which aims to ‘build
consumer, business, andregulator trust in crossborder flows of personal
information’, making it
only the 7th APEC
country to do so,highlighting an increased
focus on privacy.

The national privacy
regulator is the Officeof the AustralianInformation
Commissioner.

Regulator: The Office of
the New Zealand Privacy
Commissioner was
established toadminister the Privacy
Act 1993. The Privacy
Commissioner is
entrusted to protect
personal information of
New Zealanders inaccordance with thePrivacy Act.

Primary legislation: Law on
Network Information
Security (86/2015/QH13)(‘NIS Law’)

The Administrative Measures for
the Multiple Level Protection
System of Information Security
collectively released by (i) the
Ministry of Public Security,(ii)National Administration of State
Secrets Protection, (iii) the State
Cryptography Administration
Bureau, and (iv) the Information
Office of the State Council cameinto force in 20076, providing
relevant rules for Multiple Level
Protection System (these measures
are generally referred to as “MLPS1.0”).
In addition to above-mentioned laws
and regulations, there are various
national standards on privacy anddata protection in China i.e. therecommended national standards theInformation Security TechnologyPersonal Information Security
Specification (the “Personal
Information National Standard”)
released by the National Information
Security Standardization TechnicalCommittee in 2017. Please note thatafter going through several rounds ofrevision since the end of 2018, thesecond edition of the Personal
Information National Standard7 wasreleased on 6 March 2020 and will beeffective from 1 October 2020.

1

The Chinese text of the CSL is available at http://www.npc.gov.cn/wxzl/gongbao/2017-02/20/content_2007531.htm
The Chinese text of the General Principles of the Civil Law of the PRC is available at http://www.npc.gov.cn/zgrdw/npc/xinwen/2017-03/15/content_2018907.htm.
The Chinese text of the PRC Criminal law amended in 1997 is available at http://www.npc.gov.cn/wxzl/wxzl/2000-12/17/content_4680.htm, and the Chinese text of the Amendments XII and IX which criminalized the intrusion of information systems and other cybercrimes is available at http://www.npc.gov.cn/wxzl/gongbao/2009-06/09/content_1517170.htm and http://www.npc.gov.cn/zgrdw/npc/xinwen/2015-08/31/content_1945440.htm respectively.
4
The Chinese text of the decision is available at http://www.npc.gov.cn/wxzl/gongbao/2013-04/16/content_1811077.htm
5
The Chinese text of the measures is available at http://www.miit.gov.cn/n1146285/n1146352/n3054355/n3057724/n3057729/c4700145/content.html.
6
The Chinese text of the administrative measures is available at http://www.gov.cn/gzdt/2007-07/24/content_694380.htm.
7
The Chinese text of the national standard is available at http://c.gb688.cn/bzgk/gb/showGb?type=online&hcno=4568F276E0F8346EB0FBA097AA0CE05E.
2
3Page 2 of 14

2.

Additional rules N/A
for financial
services(Confidentiality,
Information
Security, Bank
Secrecy, including
relating tointercompany
third-party
transfers)(Any additional
regulation oncollection,
processing, ortransfers of
personal or critical
data etc.
applicable toregulated financial
services or
payments /applicable tofinancial
institutions only.)

N/A

China Banking and Insurance
Regulatory Commission (the“CBIRC”), China Securities
Regulatory Commission (the“CSRC”), and the People’s Bank of
China (the “PBOC”) are thesectoral regulators for the financial
services industry. Each of these
sectoral regulators have issued
certain sectoral rules that covercybersecurity and data protection,
including but not limited to thefollowing:

The Hong Kong Monetary Section 47 of the
Authority has issued a
Banking Act (“BA”) sets
Circular on Customer Data out the banking secrecy
Protection and a
and confidentiality
Supervisory Policy Manual obligations. Section 47
on Risk Management of E- of the BA prohibits
banking which containbank/bank officers inprovisions that areSingapore fromrelevant to data
disclosing customer
protection.
information to any
While there continues to beother person (except as
divided interpretations on Other regulators (such as expressly provided inwhether the term “under
the Securities and Futures the BA). Disclosure ofcompulsion of law”
Commission) and industry customer information• The Personal Financial Information encompasses only Indian
associations (such as the may be allowed for theProtection Technical Specification
law or also include foreign Insurance Authority) have purpose of outsourcingthat was released by the PBOC on 13 law, considering that the RBI respectively publishedof the bank’s
February 2020.
has not limited theguidelines covering
operational functions
definition by specifying that outsourcing, which also
among other available• The Administrative Measures on
the disclosure would be as contain relevant provisions exceptions.
Anti-money Laundering and Counter- per Indian laws, it may berelating to data protection.
terrorist Financing by the Banking
interpreted to include
For example, the SFC has In relation to
Financial Institutions that was issued disclosures mandated byrecently issued a Circular governance, systems,by CBIRC 19 January 2019.
foreign law.
to Licensed Corporations and controls, theon the use of external
Monetary Authority of• The Guidelines on Dataelectronic data storage
Singapore (“MAS”) has
Governance of Banking Financial
providers.
issued the Technology
Institutions that was issued by the
Risk Management
CBIRC on 21 May 2018.
The SFC also issue circulars Guidelines (“TRMfrom time to time in
Guidelines”) published• The Implementing Measures for the
response to specificin 2013.
Protection of Rights and Interests ofthreats.
Financial Consumers that was issued
Other guidelines issued
by the PBOC on 14 December 2016.
by the MAS for financial
institutions to mitigate• The Guidelines on Protection of
cybersecurity risks,
Rights and Interests of Banking
include the Outsourcing
Consumers that was issued by the
Guidelines and Business
CBRC (now CBIRC) on 30 August 2013.
Continuity Management
Guidelines (“BCM• The Circular on Emphasis to
Guidelines”).
Banking Financial Institutions on
Protecting Personal Financial
A licensee under the
Information that was issued by the
Payment Services Act
PBOC on 21 January 2011.
must comply with thecyber hygiene• The Provisional Rules onrequirements as set out
Management of the Individual Credit
in the MAS Notice on
Information Database that was
Cyber Hygiene and put
issued by the PBOC on 18 Augustin place appropriate
2005.
safeguards to protect
customer information. A
In 2011, PBOC Notice to Urge Banking
licensee should also
Financial Institutions to Protect
understand and apply
Personal Information, Article 3.6
the relevant MAS
Guidelines such as the• Requesting domestic storage and
TRM Guidelines and Eprocessing
payments User
• Personal financial information
Protection Guidelines.
(PFI) of Chinese citizens collected
in PRC shall be stored, processed
and analyzed in PRC.
In 2019, CBIRC Banking Financial
Institutions Anti-money Launderingand Counter Terrorist Financing
Management Measures (CBIRC 2019
Decree No. 1), Article 28• Prohibiting cross-border transfer
of client identification andtransaction info collected during
AML/CTF process

RBI has recognized that abanker’s “obligation tomaintain secrecy” arises
out of the contractual
relationship between thebanker and client,whereby no information
should be divulged tothird parties”.

The Personal Data
Protection Code ofPractice for the Banking
and Financial Sector
issued by theCommissioner.
Banking secrecy provisions
are stipulated in the
Financial Services Act
2013 (“FSA”) and theIslamic Financial Services
Act 2013 (“IFSA”), which
prohibit financial
institutions and officers ofa financial institution fromdisclosing customer
information to any
person, except as
expressly provided in the
FSA and IFSA.
The Central Bank of
Malaysia (Bank Negara
Malaysia or “BNM”) has
issued several guidelines
and policy documents in
respect to the
management of customer
information, which
include (but are notlimited to): (a) Policy
Document on
Management of Customer
Information andPermitted Disclosures; (b)Policy Document on
Outsourcing; (c)Guidelines on DataManagement and MIS
Framework; (d) Policy
Document on Risk
Management inTechnology (“RMiT”).

The Bank of Thailand (the‘BOT’) has issued the BOT
Regulation pursuant to
the Financial Institution
Act 2008. This includes a
Know Your Customer(KYC) guideline fordeposit taking financial
institutions, which
requires them to set up
an appropriate Data
Governance Policy andData Classification Policythat covers every processof data usage including
the method to collect,
access, transfer, anddestroy customer
personal data in order toensure that such data issecured.
The BOT has also issued aguideline on Information
Technology Risk.
For payment systemproviders, BOT has issued
regulation no.4/2018
under the Payment
System Act 2017. This
governs personal dataprotection of the payment
system user by thepayment system provider.
Note that the PDPA
supersedes this Act withrespect to collection, use,
or disclosure of personaldata.

Key rules for the financial
services sector include:

Republic Act 1405 is the
The government oflaw that prohibits theVietnam issued Decree
disclosure or inquiry into
No. 117/2018/ND-CP on
Banking Secrecy Rules:
deposits with any banking confidentiality
1. Law No. 7 of 1992 on institution. All deposits ofand disclosure of
Banking as amended
whatever nature withcustomer information of
by Law No. 10 of 1998 banks or banking
credit institutions and2. Regulation of Bank
institutions in the
branches of foreign banks
Indonesia (“BI”) No.
Philippines including(Decree 117). Decree 117
2/19/PBI/2000 on
investments in bonds
took effect on November
Requirements andissued by the
1, 2018, replacing Decree
Procedure on the
Government of theNo. 70/2000/ND-CP of
Granting of Order orPhilippines, its political2000 on confidentiality,
Written Approval tosubdivisions and its
storage, and disclosure ofDisclose Banking
instrumentalities, areinformation related to
Secrecy
hereby considered as ancustomer deposits
absolutely confidential(Decree 70).
BI Transparency Rules:
nature and may not be
Regulation of BI No.
examined, inquired or
7/6/PBI/2005 and Circular looked into by anyof BI No. 7/25/DPNP- both person, governmenton Transparency ofofficial, bureau or office,Banking Products
except upon written
Information and the Use of permission of the
Customer Personal Datadepositor, or in cases of
impeachment, or upon
Indonesia Financial
order of a competent
Authority (Otoritas Jasa
court in cases of bribery
Keuangan – “OJK”)
or dereliction of duty ofCustomer Protection
public officials, or in cases
Rules:
where the money
1. Regulation of OJK No. deposited or invested is
1/POJK.07/2013 on
the subject matter of the
Customer Protection
litigation.
in the Financial
Services Sector (asBanko Sentral ng Pilipinas
partly revoked by(BSP) issued Circular 982
Regulation of OJK No. “Enhance Guidelines on
76/POJK.07/2016 and Information Security
Regulation of OJK No. Management” to strengthen
18/POJK.07/2018)
cyber security polices among
2. Circular of OJK No.
the financial organizations.
14/SEOJK.07/2014 on According to the Circular, allConfidentiality andsupervised financial
Security of Customer institutions should establish
Personal Information robust and effective
and/or Datatechnical security risk
3. Regulation of OJK No. management processes,
38/POJK.03/2016 on
governance andthe implementation
cybersecurity controls toof risk management
prevent compromise of theirin the use offinancial stability; to ensure
information
operational resilience; andtechnology by
to protect the data of thecommercial banks as
consumers.
amended byRegulation of OJK No. In Circular 982, Section 2.6,
13/POJK.03/2020
it states that in designing
the Information Security
Others:Program, financial
Regulation of BI No.
institutions must consider
18/40/PBI/2016 on
relevant laws andPayment Transaction
regulations including theProcessing Operators andPhilippines Data Privacy Act
Regulation of BI No.
of 2012 to support the data
14/23/PBI/2012 on Fund
privacy requirements.
Transfer, as implemented
by:a. Circular of BI No.
18/41/DKSP on
Payment Processing
Implementationb. Circular of BI No.
15/23/DASP on FundTransfer as partly
revoked by Circular of
BI No. 16/1/DKSP on
Fund Transfer
ReportingMultiple Privacy
guidelines are publishedby PPC. Data protection is
included in FISC guideline
for financial industry.
FISC:
https://www.fisc.or.jp/eng
lish/ additional rule isavailable for international
data transfer from EU,
based on GDPR adequacy
decision.

Financial sectors are
required to comply withFinancial Supervisory
Commission (FSC)“Measures for the
Security Maintenanceof Personal Data of
Non-Public
Organizations” (非公務機關個人資料檔案安全維護辦法) whereas
detail privacy security
requirements.
If the process of PI
concerns with third party
or cloud, it also needs tocomply with
“Regulations Governing
Internal Operating
Systems and Proceduresfor the Outsourcing of
Financial Institution
Operation”.

There are broadconfidentiality andinformation security
laws that apply to thebanking sector inAustralia, which
extends to theprotection of personal
information. Theseobligations have their
origin in legislation &common law andequity. There are also
obligations that need
to be followed underindustry codes (suchas the Code of
Banking Practice) andregulator guidelines(such as APRA’s CPS
234).

No information foundthat is released by the
Reserve Bank of New
Zealand (RBNZ) and the
New Zealand Financial
Markets Authority(FMA).
Most banks refer to theAustralian standards suchas APRA CPS 234:
Information Security
Prudential Standard.

The Privacy Act 1993 gives
the Privacy Commissioner
power to issue codes ofpractice that become partof the law. These codes
may modify the operationof the Act for specificindustries, agencies,
APRA’s CPS 234 has
activities, or types ofprovisions that need to personal information.
be complied from a
Codes often modify one or
third-party transfer
more of the information
perspective, in addition privacy principles to taketo the general rules that account of special
the banking industry
circumstances, whichmust comply with under affect a class of agencies
the Privacy Act 1988.
(e.g. credit reporters) or aclass of information (e.g.
health information).
Credit Reporting Privacy
Code 2004 applies specificrules to credit reporters tobetter ensure theprotection of individual
privacy. The code
addresses the credit
information collected,
held, used, and disclosed
by credit reporters. For
credit reporters, the codetakes the place of theinformation privacy
principles.
Superannuation Schemes
Unique Identifier Code1995 provide agencies
involved with certain
superannuation schemeswith a potential exemption
from information privacy
principle 12(2) when thoseagencies reassign a unique
identifier for clients.
New Zealand Bankers
Association (NZBA) is a
non-profit, unincorporatedorganisation funded bymember banks throughsubscriptions. Fullmembership of the
Association is open to any
bank registered under theReserve Bank of New
Zealand Act 1989. Industry
body commitment torespect customers,
including privacy andinformation security.
Generally, the code
specifies:- When you deal with us,
we will do these things.
- Treat you fairly andreasonably.
- Communicate with you
clearly and effectively.
- Respect your privacy andconfidentiality and keep
our banking systems
secure.
- Act responsibly if weoffer or provide you withcredit.
- Deal effectively with yourconcerns and complaints.
Also sets out guidelines tohelp banks meet the needsof older and disabledcustomers.

Page 3 of 14

EU / UK
3.

Proposed new
data privacy andprotection rules

No amendments to the
GDPR are currently
proposed. However, theEU’s ePrivacy Directive(governing, amongst
other things, the use of
cookies and electronic
marketing) is currently
being revised. The
revised ePrivacy
Regulation was due in2018 but has still notbeen agreed. It is now
unlikely to be in force
before 2023, with a twoyear implementation
period to 2025.
In addition, the legislative
landscape in the UK could
be subject to change
following the expiration of
the Brexit ‘transition
period’ at the end of
December 2020.

New

A controller does not haveto notify a regulator ordata subjects of a data
breach if the breach isunlikely to result in a risk
to the rights and freedomsof natural persons.

APEC Privacy
Framework and theASEAN Framework
No plan to revise
privacy rules but
growing consensus
around need to revise
APEC cross borderprivacy rules system,
given lack of take up
and inaccessibility forbanks and SMEs,
among others.

China
Since the passage of the CSL in2016, the Cyberspace
Administration of China (the“CAC”) has been making various
rules to implement the CSL. The
CAC released various draft rules in2019 on cybersecurity and dataprotection, such as:

India
Personal Data Protection
Bill (PDPB) 2019(Published 3 Feb 2020)

Hong Kong

Singapore

Yes – on 13 January
PDPC consulted in 20172020, a consultation
on a mandatory data
paper was issued by thebreach notification
Constitutional andregime and theOn 27 July 2018, a
Mainland Affairs Bureau introduction ofcommittee of experts led by along with“legitimate interest” as
Justice Srikrishna presented Commissioner
a basis to collect, use, or
their report- along with draft suggesting potential
disclose personal data
data protection legislation- areas of reform to theregardless of consent.
• The draft of Measures for thetitled the ‘Personal DataPDPO (“Consultation
Administration of Publishing Cyber Protection Bill, 2018’ to the Paper”), which
PDPC’s Guide toThreat Information that was released Ministry of Electronics and recommended:Managing Data Breaches
on 20 November 2019 for publicInformation Technology(i) the introduction of a
2.0 dated 22 May 2019consultation.
(“MEITY”).
mandatory data breachprovides (nonnotification mechanism; mandatory) guidelines• The draft Measures on Security
Thereafter, on 10 December (ii) raising theas to when an
Assessment on Cross-border Transfer 2019, a revised copy of the sanctioning powers oforganisation is requiredof Personal Data was released on 13 (draft) Personal Data
the Commissioner toto notify the PDPC
June 2019 for public consultation.
Protection Act, 2019 (“PDP directly impose
and/or affectedBill”) was circulated toadministrative fines forindividuals about a data
• The draft of Regulations oncertain stakeholders such as the contravention of the breach. These guidelines
Administration of Data Security was Members of Parliament. It is PDPO;
will likely form thereleased on 28 May 2019 for public unclear as to when the PDP (iii) the PDPO beframework that will be
consultation. These draft regulations Bill will be tabled inamended requiring data introduced by the PDPC
specify the rules on the protection of Parliament.
users to formulate a
as part of the mandatory
personal data and important dataclear retention policy,
data breach notification
under the CSL.
The Joint Parliamentary
specifying a retention
regime. These are
Committee (“JPC”) on 3 Feb period for the personalbroadly similar to GDPR
• The finalized version of the2020 launched a three
data collected;
provisions.
Measures for Cybersecurity
weeks long consultation on (iv) amending theAssessment was released on 13 April the PDP Bill. The JPC also
definition of personal
2020 and will come into force on 1
signalled an option of indata; andThe PDPC has indicatedJune 2020. These measures are made person meeting. Earlier, the (iv) that the PDPO should its intention toto implement Article 35 of the CSL,
JPC was granted time until be amended so that data introduce a data
which requires that any purchase of the end of the budget
processors are directly
portability requirement
network products and services by the session (typically held
accountable for personal in Singapore.
critical information infrastructure (the between February and May) data retention and“CII”) operators (the “CIIO”) thatto table its report.
security, and render
Under the PDPC’s Guide
affects or may affect state security isthem responsible forto Managing Data
subject to relevant cybersecurity
Issues with the PDP Bill are data breach notifications Breaches 2.0, an
assessment.
set out where relevant inupon becoming aware of organisation needs to
the rest of this table.
any data breach
notify PDPC when the
Recent ASIFMA/GFMA submissions toincidents
data breach is:these consultations are set out
Data fiduciaries are required
below:
to notify the DPA as soon as There was no indication in • likely to result in1) 12 July 2019, Draft of the Measures possible and within such
the Consultation Paper ofsignificant harm or
on Security Assessment on Crosstimelines, as specified by the an express timeframe for
impact to theborder Transfer of Personal Data –DPA of personal data
the completion of theindividuals to whom
LINK
breaches likely to cause
review process or when
the information
2) 24 June 2019, Draft of theharm to data principals.
specific amendments torelates; orMeasures on Administration of Data Such reportings should
the PDPO would be• of a significant scale
Security – LINK
include details of the nature proposed.
(i.e. a data breachof data breach, number of
involves personal data
The Ministry of Industry andaffected data principals,of 500 or more
Information Technology (the “MIIT”) possible consequences andindividuals).
has also released certain draft rules remedial measures.
in 2019 for the implementation of
Presumably, those data
An organisation needs
certain articles under the CSL, suchbreaches which do not cause
to notify affectedas:“harm” to data principals
individuals (including
need not be reported.
parents and the legal• The draft Measures for theUnder the PDP, the term
guardians of minors
Administration of Cybersecurity“significant harm” is definedwhose personal data is
Vulnerabilities was released on 18
as "significant harm" that
affected) when the data
June 2019.
has an aggravated effect,
breach is likely to result
having regard
in significant harm or• The draft of Implementing
to the nature of the
impact to the individuals
Measures for the Security Detection personal data being
to whom theof Critical Network Equipment was processed, the impact,
information relates.
released on 4 June 2019.
continuity, persistence,or irreversibility of the harm.
As such, it follows that
The national standard for MLPS 2.0,
potential exemptions forwhich comprises of various national
breach notification exist
standards that have been revamped,
where personal data is
has been jointly released by the Statesubjected to encryption
Administration of Market Regulationor anonymisation suchand the Standardizationthat the breach is not
Administration of China earlier inlikely to result inJune 2019.
significant harm or
impact to theindividuals.

Malaysia
In February 2020, theCommissioner issued the
Public Consultation Paper
No.1/2020 on Review of
the Personal Data
Protection Act 2010,
which proposed wide
ranging reforms to the
PDPA, including:• The imposition of direct
obligations on dataprocessors to comply
with the PDPA;• Introduction of newrights and concepts in
the PDPA, such as theright to data portability
and the concept ofprivacy by design;• Requirement for data
users to appoint a dataprotection officer;• Introduction of amandatory data breach
notification regime;• Removal of the“whitelist” provisions in
the PDPA for transfersof personal data outsideof Malaysia;• Establishment of a Do
Not Call Registry in
Malaysia;• New provisions toprovide for the data
subjects’ right to bringcivil claims against thedata user for breach of
the PDPA;• Extending theapplication of the PDPA
to the Federal and State
Governments, as well as
to non-commercial
activities;• Exemption of businesscontact informationfrom the ambit of the
PDPA;• Extra-territorial
application of the PDPA
in respect of persons
who monitor the
behavior of Malaysiandata subjects, etc.
The public consultation
period ended in March
2020 but it remains to be
seen when the proposed
reforms will be officiallytabled in Parliament.

Thailand
Provisions under
Chapters 2, 3, 5, 6, 7 andSections 95 and Section
96 of the PDPA will
become effective on 27
May 2020.

Indonesia
The following new piecesof legislation are
anticipated in Indonesia.
The timing for the
introduction of each
additional law remains
unknown.

Pursuant to section 37 (4), 1. Law on Personal Datathe data breachProtection – this will be
notification would not be
general framework on
required if such breachpersonal data protection
has no risk of impact toregulation in Indonesia
the right and freedom of(the “Personal Data
any person. In addition,
Protection Law”)
the exemption of data
breach notification will be The draft Personal Data
set out in the PDPC’s
Protection Law is intended
notification (nothing
to be an umbrella
further actuallylegislation for personalprescribed).
data protection inIndonesia. Currently,
personal data protection inIndonesia is piecemeal,
being set out in several
regulations. Much of thedraft Personal Data
Protection Law draws on
concepts in the European
Union’s General Data
Protection Regulation(“GDPR”). The draft
Personal Data Protection
Law includes, among
others, (1) concepts of data
controllers and dataprocessors (2) concept ofsensitive personal data and(3) other legal basis fordata processing, mainly
inspired by the GDPR, butalso includes otherconcepts unique toIndonesia, such as theconcept of personal data
“owners" (rather than data
“subjects”) and imposing
criminal sanctions forcertain data breaches. The
draft Personal Data
Protection Law also
prohibits the sale ofpersonal data.

Philippines
There are two pendingNonebills to amend the DPA:
http://congress.gov.ph/legis
docs/basic_18/HB05612.pdf
http://congress.gov.ph/legis
docs/basic_18/HB01188.pdf
Public consultations are
currently being conducted,
and the local finance sector
is actively participating.
(Dondi from Citi pointed
out that these are taking
lace)
Exemptions for breach
notification:
Notification is not required
if the National Privacy
Commission determines:
1.that notification is
unwarranted after taking
into account compliance by
the Personal Information
Controller with the Act andthe existence of good faith
in the acquisition of
personal information, or
2. in the reasonable
judgment of the National
Privacy Commission, such
notification would not be in
the public interest or in theinterests of the affected
data subjects.

VietnamJapan

TaiwanPIPA will be amended in2020. (It is amended
every 3years inaccordance with Law
definition.)

There is no concrete
proposal for
amendments to thecurrent Data Privacy Act
of the Philippines.

Australia

New Zealand

There are currently no
proposed new laws
for privacy inAustralia; however,the AustralianCompetition and
Exemptions for breach
Exemptions for breachConsumer
notification:
notification:
Commission released
It is not legally required to There are no general
their Digital Platforms
report a data breach
exemptions for breach
Inquiry Report inincident to the PPC or to
notification as in general 2019, which
notify the relevant data
where personal data ishighlighted several
subjects. With reference to stolen, disclosed, altered, areas that need
PPC guidelines, if a factual or infringed in other ways strengthening insituation demonstrates
due to the violation ofAustralian privacy
that the Personal Data,
the PDPL, the datalaw- most notably
which has been disclosed, controller should notify
around rights andwas immediately collected the data subject after due consent. In response,
before being seen by any
inquiry.
the Australian
third party or not actually
Government
disclosed, the notice to theindicated that these
PPC or any other relevant
recommendations will
authority is not necessary.
be further examined
An example is that thein 2020 to support
company has
any policy proposal
encrypted the data orfor privacy law uplift.
otherwise secured the datain such a way that it has
become useless to third
parties being in possessionof such data.

New Zealand
Government iscurrently in the processof making changes to
the Privacy Act. The
Minister of Justiceintroduced a Billamending the current
Act on 20 March 2018,
which is anticipated tobe passed in 2020.

Breach notification:
A data controller must
submit written notification
within 3x24 hours to: (i) the
relevant personal data
owner; and (ii) MOCI if
there is any failure topersonal data protection.
This obligation would be
exempted for the purposeof: (i) national defence andsecurity interests, (ii) legal
enforcement interests, (iii)public interests in thecontext of stateadministration, (iv)supervisory interests forthe financial, monetary,
payment system andfinancial system’s stability,or (v) data aggregation forthe purpose of statisticaland scientific research instate administration.

Page 4 of 14

EU / UK
4.

Proposed newNonefinancial services
sector rule(e.g.
Confidentiality,
Information
Security, Bank
Secrecy, including
relating tointercompany
third-party
transfers)

APEC Privacy
Framework and theASEAN Framework
N/A

China
• As reported, the PBOC recently
prepared a draft of the Interim
Measures for the Protection of
Personal Financial Information,
which provided draft measures tocertain Chinese financial
institutions in October 2019 for
consultation. These draft measures
may apply to the collection,
processing, use, and disclosure of
personal financial data by various
financial institutions in China.
These measures, when finalized,
may consolidate the requirements
on protecting personal financial
data of banking individual
customers that are scattered invarious rules.
• The PBOC released a new draft of
the Implementation Measures for theProtection of Rights and Interests ofFinancial Consumers on December 27
2019 (the “Draft Implementation
Measures”). The Draft
Implementation Measures aim to
replace (i) the Implementation
Measures for the Protection of Rights
and Interests of Financial Consumers
that were issued by the PBOC andcame into force on 14 December
2016 and (ii) the Administrative
Measures for the Protection of Rights
of Financial Consumers (Trial) thatwere issued by the PBOC and cameinto force on 7 May 2013. The Draft
Implementation Measures reiterate
data storage and processing
localization requirement as well asother protection obligations offinancial institutions in terms of theirprocessing of consumer financial
information.

India
None

Hong Kong
None

Singapore
TRM Guidelines and
BCM Guidelines may beamended to enhancefinancial institution
cybersecurity resilience
with a focus on
governance andoversight.
[The Payment Services Act
has commenced on 28 Jan
2020]

Malaysia
N/A

ThailandNone

Indonesia
None as at the date ofthis summary table

Philippines
None

Vietnam
None

Japan
N/A

TaiwanNo concrete proposal
for additional data
privacy and protection
rule.

Australia
None

New Zealand
No information foundthat is released by the
Reserve Bank of New
Zealand (RBNZ) and the
New Zealand Financial
Markets Authority(FMA).
Changes to the Credit
Reporting Privacy Code(Amendment No 14) weremade in three stages in
2019, following a 18month review into theoperation of thecomprehensive credit
reporting system. Thechanges were intended tomake the credit reporting
system fairer for
consumers and improve
enforcement andcompliance.
Amendment No. 14
changes came into force inthree phases on 1 July, 1April, and 1 October 2019.
The latest changes
increase the threshold forlisting overdue payments
as defaults in credit
reports. It also oblige
credit providers to issue
quotation enquiries whenoffering risk-based pricing
for credit products.
Superannuation Schemes
Unique Identifier Code1995 Amendment No. 1.
The Code has been
amended by Amendment
No. 1 and commenced on
15 October 2015.
Amendment No 1 will
make two minor changes
to the Code. Firstly, it will
amend the definition of
the term “associatedperson” to replace areference to section OD7of the Income Tax Act
1994 (which has since
been repealed) with its
current equivalent –subpart YB of the Income
Tax Act 2007.
Secondly, it will remove
clause 3(2). This
subsection sets out thatterms and expressions
used in the Code but
which are defined in the
Privacy Act 1993 or Acts
Interpretation Act 1924
(which has since been
replaced by theInterpretation Act 1999)
have the same meanings
respectively as in those
Acts.

Page 5 of 14

EU / UK

Definitions

5.

APEC Privacy
Framework and theASEAN Framework

Definition ofDefinition of Personal
The APEC Framework‘Personal’ data (or Datadefines personal
similar), andUnder Article 4 of theinformation as any
extraterritorial
GDPR, "personal data"
information about anapplication/exclus means any information
identified orions related torelating to an identified or identifiable individual.
such definitions identifiable natural person( the "data subject"). An
The definition is
identifiable natural person intended to include
is one who can beinformation that would
identified, directly or
not meet the above
indirectly, in particular by criteria alone, but whenreference to an identifier put together with othersuch as a name, aninformation would
identification number,
identify an individual.
location data, an online
identifier or to one or
The Framework ismore factors specific tointended to apply tothe physical, physiological, information about
genetic, mental, economic, natural living persons,cultural or social identity not legal persons.
of that natural person.
The ASEAN Framework
Extra-territorial
does not have a
Application
definition.
Under Article 3 of the
GDPR, the GDPR applies
to:• the processing of
personal data in thecontext of the activities
of an EU establishmentof a controller orprocessor; or• the processing of
personal data of a data
subject in the EU, by a
non-EU controller orprocessor, if theprocessing activities
relate to:a) the offering of goods
or services to a EU
data subject; orb) the monitoring of adata subject's
behaviour in the EU.

China

India

Hong Kong

Singapore

Malaysia

Clear definition
Personal data refers to any
information, in electronic form orother form that is able to directly orin combination with otherinformation identify an individual orreflects an identified individual’s
activities including but not limited toname, identification number,correspondence address, residential
address, account information,
financial information, and location
data.

The PDP Bill defines‘Personal Data’ as ‘dataof or about a natural
person which makes her
identifiable directly or
indirectly (anycharacteristic, trait,
attribute or any otherfeature of the identity ofsuch natural person, or
any combination of suchfeatures, or any
combination of suchfeatures with any otherinformation, whether
online or offline, andincludes any inference
drawn from such data forthe purpose of profiling).’

The PDPO defines"Personal Data" as any
data:

The PDPA defines“personal data” as data,
whether true or not,about an individual who
can be identified fromthat data, or from thatdata and otherinformation to which anorganisation has or is
likely to have access.

The PDPA defines‘Personal data’ as, in thecontext of commercial
activities, any informationthat relates directly or
indirectly to an individual,
where the individual isidentified or able to be
identified from that
information, or from that
information wherecombined with otherinformation in thepossession of a data user.

(a) relating directly or
indirectly to a living
individual;(b) from which it ispracticable for theidentity of the individual
to be directly or
indirectly ascertained;
andThe PDPA applies to allorganisations which are
not a public agency or
acting on behalf of a(c) in a form in which
public agency (noaccess to or processing
matter whereof the data is practicable. incorporated) thatcollect, use or disclose
The PDPO does not
personal data in
The Bill is applicable to (i)confer extra-territorial
Singapore.
data used, shared, disclosed, application and so thecollected or otherwise
usual territorial principle
processed in India; (ii) data should be applied inprocessed by an Indian
construing the provisions
citizen, company/ bodyof the PDPO.
established under Indianlaw, or the State; (iii) entities
not based in India but which
conduct activities likeprofiling, which could cause
privacy harms to data
principals in India, even if
not based in India; (iv)entities not based in India
but which carry on theirbusiness/ offers goods orservices to data principals in
India.
Following an approachsimilar to the GDPR, the Billshall be applicable to datafiduciaries not in India when,(i) personal data isprocessed in connection
with business or service
activities offered to data
principals within the Indian
territory, and (ii) activities
involving profiling of data
principals within the Indian
territory. Companies
incorporated in India would
be subject to the Bill,regardless of where theactual processing/ storage
etc. takes place.

The PDPA does not apply
to the Federal and State
Governments.
The PDPA does not apply
to personal dataprocessed outside
Malaysia unless that
personal data is intended
to be further processed in
Malaysia. In practice thisintention can beconstrued as being at the
point in time that the data
is further processed in
Malaysia where thiscannot be clearly
determined at the outset.

ThailandThe PDPA defines“Personal Data” asinformation relating to anatural person which is
directly or indirectly
identifiable to suchnatural person, excluding
information of a
deceased person.

Indonesia
GR 71 defines Personal
Data as every individual
data which is identifiable
and/or can be
identifiable, alone or
combined with otherinformation, directly or
indirectly, through anelectronic system and/or
non-electronic system.

Philippines
The Data Privacy Act
defines Personal Data as
any information, whether
recorded in a material
form or not, from which
the individual can be
identified by the entity
holding the information,or when put together
with other information.

VietnamJapan

Personal information is
The Privacy Act defines
defined broadly by the‘personal information’ as
Network Information
information or an
Security (NIS)
opinion about an identified(86/2015/QH13) Law as
individual,
information relating toor an individual who is
the identity of a specificreasonably identifiable
person. The personal
whether the information
information owner is theor opinion:
person identified by the• is true or not; andpersonal information.
• is recorded in a material
The EIT Law adopts theData Privacy act Section 6: This includes any
form or not.
principle of“Extraterritorial
information that relates
extraterritoriality as it also Applications”, states thatto a data subject’s:
applies (in theory) to any
the act applies to an act• Personal life, such as
person who undertakes
done or practice engaged in
name, date of birth,
any relevant legal acts
and outside of theaddress, telephone
within or outside
Philippines by an entity if:
number, identification
Indonesia, whether such
number, or email
person is based within or(a) The act, practice oraddress.
outside the territory ofprocessing relates to• Personal or family
Indonesia and where such personal information about
secrets.
acts harm the “interest ofa Philippine citizen or a
• Personal
Indonesia”. The term
resident;
communications,“interest of Indonesia” is(b) The entity has a link withincluding writtenvery broadly defined as
the Philippines, and thecorrespondence and theIndonesian national
entity is processing personal
content of telephone
economy interests,
information in thecalls.
strategic data protection,
Philippines or even if thethe nation’s dignity, stateprocessing is outside thedefense and security,
Philippines as long as it issovereignty, citizen andabout Philippine citizens orlegal entities, etc.
residents such as, but notlimited to, the following:
The extraterritoriality(1) A contract is entered inprinciple as adopted by the the Philippines;
EIT Law could be(2) A juridical entity
interpreted to mean thatunincorporated in the
any implementing
Philippines but has central
regulations under the EIT
management and control in
Law regime may also apply the country; andthe extraterritoriality(3) An entity that has aprinciple. The practicebranch, agency, office oraround this issue is yet tosubsidiary in the Philippines
be confirmed.
and the parent or affiliate of
the Philippine entity has
access to personal
information; and(c) The entity has other links
in the Philippines such as,
but not limited to:(1) The entity carries on
business in the Philippines;
and(2) The personal information
was collected or held by anentity in the Philippines.

TaiwanPDPA defines "personaldata" refers to a natural
person's name, date ofbirth, ID Card number,passport number,features, fingerprints,
marital status, family
information, education
background,
occupation, medical
records, healthcare
data, genetic data, data
concerning a person's
sex life, records ofphysical examination,
criminal records,
contact information,
financial conditions,data concerning aperson's social activities
and any otherinformation that may
be used to directly or
indirectly identify anatural person;

Australia

New ZealandPersonal information
Clear definition
includes a broad
Personal information
range of information,
includes any informationor an opinion, thatabout an identifiable
could identify anindividual, such as a
individual. What is
name, date of birth,
personal information
address, biometricwill vary, depending
information and/or
on whether a person
gender etc. If there is acan be identified or isreasonable chancereasonably
someone could be
identifiable in theidentified from thecircumstances.
information, it is
For example, personal personal information.
information may
This also applies toinclude:individuals whose death• an individual’s name, is maintained pursuant
signature, address, to the Birth, Deaths,
Marriages, andphone number orRelationships
date of birth• sensitive information Registration Act 1995, or
any former Act.
• credit information• employee record
Application of principles
information
to information held
• photographs• internet protocol (IP) overseas(1) For the purposes ofaddresses• voice print and facial principle 5(governs theway personal
recognition
biometrics (because information is stored. It
is designed to protect
they collectcharacteristics that personal information
make an individual’s from unauthorised use
voice or face unique) or disclosure.) and• location information principles 8 to 11 (placefrom a mobile device restrictions on how
people and organisations(because it canreveal user activity can use or disclosepatterns and habits) personal information.
These include ensuring
information is accurate
The Privacy Act
1988 doesn’t cover the and up-to-date, and that
it isn't improperly
personal information
disclosed.), informationof someone who has
held by an agency
died.
includes information thatis held outside New
Ref:
https://www.oaic.gov. Zealand by that agency,
where that information
au/privacy/yourhas been transferred out
privacy-rights/yourof New Zealand by that
personalagency or any otherinformation/what-ispersonal-information/ agency.
(2) For the purposes ofprinciple 6 (gives
individuals the right toaccess information about
themselves.) andprinciple 7 (gives
individuals the right tocorrect information
about themselves.),
information held by anagency includes
information held outside
New Zealand by thatagency.
(3) Nothing in thissection shall apply torender an agency inbreach of any of theinformation privacy
principles in respect of
any action that theagency is required totake by or under the lawof any place outside New
Zealand.

Page 6 of 14

EU / UK
6.

APEC Privacy
Framework and theASEAN Framework

Definition of
Article 9 of the GDPR
N/A
‘Sensitive’
defines "special
personal data (or category data" as
However, the APEC
similar), andpersonal data that:
Framework provides
extraterritorialthat the credit card
• reveal racial/ethnic
application/exclus origin;numbers, bankions related to• reveal political opinions; account informationsuch definitions • reveal religious or
and sensitive personal
information isphilosophical beliefs;
referred to in• reveal trade union
discussion on
membership;obtaining data fairly• genetic data;• biometric data for the and proportionally topurpose of identifying a what data will be
used for.
person;• concerning health;• concerning a person’s
sex life; and• concerning a person’s
sexual orientation.
Criminal conviction data isalso given additional
protection under the
GDPR, although it does not
fall within the scope of
special category data.
Special category data
under the GDPR does notinclude financial data or
government issued ID
documents and the list set
out in Article 9 (asdescribed above) is
exhaustive.

China
No clear definition at law but there
is a clear definition in the Personal
Information National Standard andthis is generally accepted.

India

Hong Kong

Singapore

Malaysia

The ‘PDP Bill’ defines
Not applicable as
Not applicable as
The PDPA defines
Sensitive Personal Data”'sensitive personal data' “Sensitive” personal‘Sensitive personal data’
as a sub-set of personal
is not defined in thedata is not defined
as any personal data
data that reveals, relates
PDPO.
under the PDPA.
consisting of information
to or constitutes sensitive
as to the physical or
The Personal Information National
information such as
However additional
However, based on past mental health orStandard defines sensitive personal financial information,
guidance is issued for ID decisions by the PDPC,
condition of a data
data as certain personal data that is health data, biometrics,
numbers and equivalent certain types of personal subject, his politicalhighly critical and important to theofficial identifier, sex life,
identifiers and consumer data have been considered opinions, his religious
data subject where any breach ofsexual orientation,
credit data.
more sensitive than others beliefs or other beliefs ofsuch personal data, or unlawfultransgender status,and organisations thata similar nature, thecollection or abuse of such personal intersex status, genetic
More specifically thecollect, use or disclose
commission or alleged
data, will give rise to danger anddata, caste/ tribe, andCommissioner has clarified such personal data would commission by him of any
impact to the data subject or his/her religious/ political belief/that biometric data should generally be expected to offence or any otherproperty, reputation, mental health, affiliation.
only be collected where it provide more robust
personal data as may beor will make the data subject to ais necessary and with the standards of protection. determined by thevictim of any discrimination. There is The DPA is empowered to consent of the data
Such types of personal
Minister ofa non-exhaustive list of sensitive
expand the scope ofsubject.
data include financial data, Communications andpersonal data under the Personal
Sensitive Personal Data frombankruptcy status andMultimedia (nothing
Information National Standard.
time to time.
There is no separate
personal identifiers (eg,further actually issued).
Examples of sensitive personal data
definition for sensitive
National Registration
include identification card numbers, Since the definition of
personal information
Identification Card andbiometric data, bank account,financial information isunder the PDPO, and there passport details).
communication records and details, broad and ambiguous, it
are no categories of data
property information, credit
could include credit card
set forth in the PDPO. For
information, whereabouts,
details, permanent account the definition of “personal
accommodation information, health number details etc., which is data”, please see row 5
and physiological information,
routinely stored by financial above.
transaction information and personal institutions to facilitate
data of minors (below the age ofknow your customer checks To the extent that it
fourteen).
and online transactions. This would be practicable tocould pose challenges toascertain a person directly
businesses offering crossor indirectly by virtue ofborder payments to/fromsuch financial information
Indian entities.
then this would likely
constitute personal data.
Alternatively, if this was
simply raw financial dataalone and it is not possible
to deduce who theperson/customer is just bysuch financial information,then it would notconstitute personal data
under the PDPO.

ThailandIndonesia

Specific categories of
personal data under
Section 26 of the PDPA
(which are subject toadditional requirements
in respect of collection
and processing, even if
not directly labelled“sensitive”) include;
personal data pertaining
to racial, ethnic origin,political opinions, cult,religious or philosophicalbeliefs, sexual behavior,criminal records, healthdata, disability, tradeunion information,
genetic data, biometricdata, or of any data which
may affect the data
subject in the samemanner, to be prescribedby the Committee(nothing further actuallyprescribed).

No definition of‘sensitive’ personal data(or similar terminology) is
provided in the key
regulations on dataprotection in Indonesia.

The general data
regulatory framework
does not cover Gov ID info
or financial info as such.
Financial info is covered byfinancial services sectoral
regulations outlined in
response to no. 2 above.

Philippines

VietnamSensitive information,
There is no specificwhich is afforded
definition of sensitive
additional protections,information under thisrefers to personallaw. However, certain
information about an
definitions of personal
individual, such as race,
information found inethnic origin, marital status, alternate laws doage, religion, philosophical reference specific types
or political affiliations,of information as
health, education, genetic or requiring protection. For
sexualexample, the Decree on
life, legal proceeding,
E-Commerce extends tocriminal history, social‘information contributing
security number,to identifying a particular
health records, tax
individual, including
records, and classified
his/her name, age, home
information.
address, phone number,medical information,account number,
information on personal
payment transactions andother information thatthe individual wishes tokeep confidential.
Sensitive data may include
data that harms theinterests of thestate/government ofVietnam or causes social
instability. Personal data
relating to religious orother beliefs or politicalopinions, for instance, mayalso be regarded assensitive, the production,
reproduction, access anddissemination of which isprohibited. The concept of"personal secrets" also
exists under Vietnamese
law and may refer tomedical records, tax
payment dossiers, social
insurance card numbers,
credit card numbers andothers as defined by law.
State agencies holding
information classified as
personal secrets may only
supply or share suchinformation with acompetent third party incases specified by law. If
the sensitive data relates
to state secrets, theinformation must be
encrypted in networktransmission andcomputer storage.

Japan

TaiwanSensitive information isrecognized as a specific
type of personal
information, which
includes information oran opinion about anindividual’s racial or
ethnic origin, politicalopinion, religious beliefs,
sexual orientation or
criminal record, healthinformation and tax filenumber information.

Data pertaining to anatural person's
medical records,
healthcare, genetics,
sex life, physicalexamination andcriminal records shallnot be collected,
processed or used
unless on certain
conditions are met.

“Special care-required
personal information” inthis Act means personal
information comprising a
principal's race, creed,social status, medical
history, criminal record,
fact of having suffereddamage by a crime, orother descriptions etc.
prescribed by cabinet
order as those of which
the handling requires
special care so as not tocause unfair
discrimination, prejudiceor other disadvantages tothe principal
According to "Guidelines
for Personal Information
Protection in the Financial
Field" Article 6 Regarding
Sensitive Information
1.An entity handlingpersonal information in
the financial field shall notacquire, use of provide to
third party, information onpolitical views, religion(meaning thoughts andcreeds), participation inunion activities, race,family origin andregistered domicile, healthcare, sex life and pastcriminal records.

According to"Regulations Governing
the Standards for
Information System andSecurity Management ofElectronic Payment
Institutions" Article 10"Sensitive data" include
but are not limited topassword, personal data,
identity data, credit card
number, credit card
verification code, andpersonalized data.

Australia

New ZealandSensitive information
Not applicable asis personal'Sensitive' personal data
information that(or similar) is notincludes information
defined in theor an opinion about
legislation. However,an individual’s:
this is something that is• racial or ethnic origin assessed by the Privacy• political opinions or Commissioner on a caseby case basis.
associations• religious orphilosophical beliefs
The Privacy Act does not• trade unioncontain any concept or
membership or
definition of sensitive
associations• sexual orientation or personal data.
However, the Privacy Act
practicesdoes require agencies• criminal record
collecting personal• health or genetic
information to only do so
information
for a "lawful purpose• some aspects
connected with aof biometricfunction or activity of theinformation
agency", and theGenerally, sensitive
collection must be
information has a"necessary" for thathigher level of privacy
purpose (Privacy
protection than otherPrinciple 1). In addition,
personal information.
information may not becollected by unlawful,
Ref:
https://www.oaic.gov. unfair or unreasonably
intrusive means (Privacy
au/privacy/yourPrinciple 4). In practice,privacy-rights/yourthis may constrain the
personalcollection of certain
information/what-ispersonal-information/ types of personal
information where theycannot be reasonably
connected to a lawful
purpose of the agency.
Health information is
subject to specificprotection through the
Health Information
Privacy Code (the"HIPC").

Page 7 of 14

EU / UK
7.

Additional
None – critical data is
categories of data not a defined concept(e.g. ‘critical’ data under the GDPR.
or similar), andextraterritorial
application/exclus
ions related tosuch data(Also states where
critical data canoverlap withpersonal orsensitive personal
data)

APEC Privacy
Framework and theASEAN Framework
N/A

China
Unclear definition

India

Applicable but not clearlyNonedefined – “critical
Important data is mentioned in the personal data” in Bill. The
China Cyber Security Law but thedefinition of “criticaldefinition of important data has not personal data” (which
yet been finalized. Chinese regulators shall only be processed inare still making rules on regulating
India) will be notified in
the use and protection of important due course by the DPA.
data.
RBI sectoral rules define“Payment data” which must
be localised.

Hong Kong

Singapore
None

Malaysia
None

ThailandNone

Indonesia
Yes, GR71 applies
requirements to‘strategic’ data.
GR71 sets out that theGovernment will
determine public
institutions or institutions
that own vital information
infrastructure in certain
sectors
Sectors include:1.

government
administration
2. energy and mineral
resources
3. transportation
4. financial
5. health
6. information andcommunication
technology
7. food (resilience)
8. defence; and9. other sectors that are
specified by the
President ofIndonesia.
10. Regulatory guidanceis needed on whether
the definition of“institution” includes
any ESO within theprivate scope. Further
details are expectedin an implementing
regulation.

Philippines

Vietnam

In DPA of the Philippines,
the Privileged
Information refers to any
and all forms of data,
which, under the Rules of
Court and other pertinent
laws constitute privileged
information. (e.g.
Attorney-Client Privilege,
Certified Public
Accountant Privilege)

The Vietnamese
government labels
information as statesecrets when:• The information elates
to a case, acircumstance, adocument, an object, alocation, a time, or aspeech that contains
important content in
the fields of: politics;
national defense;
national security;
foreign affairs;
economy; science;technology; or othersubjects designated by
the government.

Japan
None

TaiwanNoneAustralia
None

New ZealandNone

The disclosure of theinformation may cause
harm to the State of theSocialist Republic ofVietnam.

Page 8 of 14

8.

Grounds forcollection andprocessing of
personal data ortransferring thesame to third
parties in thesame jurisdiction(e.g. consent,
legitimate
business,
compliance withapplicable laws,
outsourcing)

Article 6 sets out the six
Lawful purpose andlawful basis ofnotice or consent
processing, being:
where appropriate• consent of data subject;
Under the APEC
• necessary for the
Framework, theperformance of acontract with the data collection of personal
information should be
subject or to takelimited to information
preparatory steps tothat is relevant to thesuch a contract;
purposes of collection• necessary for thecompliance with a legal and any suchinformation should be
obligation;• necessary to protect the obtained by lawful andfair means, and wherevital interests of thedata subject or another appropriate, with
notice to, or consent of,person;the individual• necessary for the
performance of a task concerned.
carried out in the public
Data should be used forinterest or in thesuch notified purposes
exercise of official
authority vested in the or other compatible orrelated purposes.
controller; andGrounds for Collection, Processing and Transferring Data Processing• necessary for the
purposes of legitimate
interests.

Under the China Cyber Security
Law, consent is the legal basis.

Consent

Lawful purpose &Consent
Consent
Consent
Consent and / or specificCollection and Notice
Collection and Notice
The APPI refers to thenotification
purposeWhen collecting personal
The NIS Law requires thatcollection of personal
Per the PDP bill, to process
Generally, an organisation Consent of data subject
Data controller must obtain
information, data must be: when collecting personal
information as proper
Compliance with laws and thepersonal data, the data
For lawful purpose bywould need to obtain an usually required subject to an individual’s consent
Under GR 71 and Regulation • Collected only for a
information, organisations acquisition. PIHBOs must
performance of contract can also be principal should havelawful and fair means.
individual’s consent forlimited exemptions.
except where relevant
20, consent must be
specific and legitimate
and individuals must collect not obtain personal
legal basis which can be derived as a consented to such
Purpose of collection must the collection, use or
exemptions apply.
conveyed explicitly, clearly purpose determined andpersonal information only information by deceit or
result of reconciliation of laws. There processing at the latest by be directly related to adisclosure of his personal Exemptions
Data controller must inform and must not be based on declared.
after obtaining the consent improper means. PIHBOs
are other exemptions of consent
the time the processing
function or activity of the data for a specified
the data subject: (i) the
fault, negligence, or• Accurate, relevant andof the information owner on must promptly andrequirements provided in thecommences. There are no data user (i.e. the person purpose unless it is
Exemptions include where purposes of collection; (ii) coercion. Consent may not kept up to date where
the scope and purpose of
explicitly inform the
Personal Information National
restrictions on intra-country who controls therequired under any law, or processing is necessary:the data to be collected; (iii) be implicit or “passive” (e.g. necessary for the declared the information collection principal whose personalStandard but these are of no legaltransfer of personal data so collection, holding,an exception under thethe rights of the data
the privacy policy shall apply purpose.
and useinformation was acquired
effect.
long as consent has beenprocessing or use of
PDPA applies.
(a) for the performance of a subject; and so forth.
whenever a user utilises the • Adequate and notof the utilisation purpose,
obtained for such transfer personal data). The data
contract to which theservices provided by theexcessive in relation to the Use and Disclosure
including where thefrom the Data Principal.
collected should be
Exemptions under thedata subject is a party;
Legitimate interests of data relevant ESO). The consent declared purpose.
The NIS Law requires that
purpose has changed.
necessary but not
PDPA(b) for the taking of steps at controller
will need to be given in• De-identified when nowhen collecting or using
However, this notice
The collection of personal
excessive in relation to
the request of the data
writing (electronically or
longer necessary for the
personal information,requirement does notdata is permitted only to the that purpose.
Exemptions include:
subject with a view toConsent is not needed
manually) and in Bahasa
declared purpose.
organisations andapply in cases where
extent necessary for theentering into a contract; where the relevant activity is Indonesia form (or bilingual
individuals must only use
there exists an urgent
purposes of processing (e.g. When personal data are
Disclosures relating to an (c) for compliance with any necessary for the legitimate version.)
The data subject is entitled collected personalneed to protect humannecessary for the services to collected from an
investigation orlegal obligation to which interest of the data
to be informed of:information for any purpose life, body or fortune, orbe provided). When a Data individual, that person
proceeding or provision of
the data user is thecontroller or any other
The exemptions available• The purpose for which the different from the initial one where the utilisation
Fiduciary collects personal (the data subject) must be legal service
subject, other than an
persons other than the data are very limited and narrow. personal information is
only after obtaining the
purpose was previously
data, it is required to give
provided with the
obligation imposed by a controller, except where
Exemptions to providing
being collected.
personal information
disclosed to the public.
clear and concise
following information,
Managing employee
contract;such interests areconsent apply in law• The scope and method of owner’s consent. They must PIHBOs must obtain theinformation about thewhich includes: (a) the
relationships(d) in order to protect theoverridden by theenforcement type scenarios processing.
not share or disclose
principal’s consent before
Where appropriate,collected data, purpose (of purpose for which thevital interests of the data fundamental rights of the
For example, if required by • The recipients or classes of personalcollecting sensitive
individuals should becollection), nature anddata are to be used; (b)Relating to M&A
subject;
data subject of his or her
Indonesian court orrecipients to whom personal information to any third
information.
provided with clear,
categories, details of data
the classes of persons to (“business asset(e) for the administration of personal data.
authorities, if requested by data will be disclosed.
party, unless it is agreed byprominent, easily
protection officer, process whom the data may betransactions”)
justice; orlaw enforcement officers in • Methods to access data. the personal information(Also see #9 below – further
understandable,of consent withdrawal,
transferred; (c) whether it(f) for the exercise of any
Exemptions
relation to criminal• The identity and contact owner or requested byabout transferring personal
accessible andconsequences of nonis obligatory or voluntary Carrying out research,functions conferred onallegations, or if otherwise details of the datacompetent state bodies.
data to third party)
affordable mechanisms
provision of personal data, for the data subject tojournalistic, literary or
any person by or under Exemptions include where required under Indonesian controller.
to exercise choice insource, third party
supply the data; (d) theartistic purposes.
any law.
processing is necessary:laws.
• The period for which the Vietnamese law defines
relation to thedisclosure, cross-borderconsequences arising if thedata will be stored.
persons 16 years old orcollection, use andtransfer, period of retention, data subject fails to supply Reasonableness (evenSection 45 of the PDPA(a) for the performance of a Additional Requirements• Any rights the data subject younger to be minors. To
disclosure of theirrights of data principals,
the data; and (e) the data with consent)
provides further partial
contract to which the data
may have.
process the personal data
personal information.
grievance redressal process, subject has the right toexemptions from certain
subject is a party, or in order In addition to obtainingof a minor, an organizationright to complain to therequest access to andOrganisations should not, data protection principles in to take steps at the request consent from personal data Data subjects shall bemust obtain the consent ofUnder the ASEAN
DPA, and share any ratingcorrection of the data.
as a condition of supplying relation to the processing of of the data subject prior to owners, GR 71 requires ESOs notified and given an
the minor’s parent or
Framework ansuch as data trust scorea product or service,personal data, e.g. in respect entering into a contract;
must process personal data opportunity to withhold
guardian.
organisation should notaccorded to it, and any
Consent for direct
require an individual toof the prevention or
for one of the following
consent in case of any
collect, use or disclose
other information that the marketing
consent to the collection, detection of crime,(b) It is necessary forspecific purposes:changes to the information The Law defines processing
personal data unless
DPA prescribes.
use or disclosure ofassessment or collection of compliance with a law to
1. to satisfy contractual declared to the data subject personal data as engaging
the individual is notified
Separately, the PDPO has personal data beyond
any tax or duty, preparing which the data controller isobligations under ansince consent was sought. in one or more of theor given consent for
Exemptions
strict requirements
what is reasonable tostatistics or carrying out
subjected.
agreement enteredfollowing activities withsuch purpose or an
relating to direct
provide such product or
research, discharging
into by the personal
Use and Disclosure
personal data:
available exemption
For personal data, (but not marketing.
service.
regulatory functions,
Data Owner, or to fulfil Personal information must
applies.
sensitive personal
A data user must obtainjournalistic, literary ora request from thebe accurate and relevant. It• Collecting.
data),where consent based consent of the data
artistic purposes.
personal Data Owner at must only be processed• Editing.
Collection, use orprocessing would require
subject to the proposed
the time the parties
fairly, lawfully, in a way• Using.
disclosure should only
efforts disproportionate to direct marketing activities.
enter into thecompatible with the• Storing.
be for a purpose athe sensitivity of such dataagreement;
declared purpose and in a
• Providing to any third
reasonable person
or is necessary for
Exemptions
2. to satisfy any legalmanner that ensuresconsiders appropriate
recruitment, termination of
obligations of the data appropriate privacy andparty.
in the circumstances.
recruitment, providing a
Exemptions for complying
controller contained in security safeguards.
• Transferring.
service/ benefit towith certain data
any applicable
Processing of personal data • Sharing.
employees, attendance and protection principles in theregulations;shall adhere to the• Publishing.
assessing employee
PDPO include:
3. to implement the
principles of transparency,
performance, the data
authority of the data
legitimate purpose andfiduciary.
Purpose of prevention orcontroller under
proportionality. Processing
detection of crime,
applicable regulations; personal information is only
Processing of personal data prevention or remedy of
4. to satisfy thelawful and permitted whereis also permissible if it isunlawful conduct.
obligations of the data the data subject has
necessary for any legislative
controller in theconsented, or it is necessary:function (central or state), Purpose of assessment orcontext of public• For the processor to fulfil aand State function
collection of tax.
service for the interest contract with the data
authorised by law for (i)of the public; and/or
subject.
providing benefit/ service to Required in connection
5. to satisfy any other• For the controller tothe data principal, or (ii)with legal proceedings inlawful interest of the comply with legal
issuing certification, license Hong Kong or exercising or
personal data
obligations.
or permit to the data
defending legal rights incontroller or owner.
• To protect the data
principal.
Hong Kong.
subject’s life and health.
Based on the strict wording • To respond to a nationalDue diligence for proposedof GR 71, it appears that the emergency, uphold public[Please include exemptions M&A .
above are additional to the order and safety, or fulfil
such as those analogous toconsent requirement, rather functions of a public
the Malaysia or EU columns Certain employment
than additional exemptions authority.
if they are in the Bill].
situations such as staff
from obtaining written• As the legitimate interests
planning
consent as such. However, of the controller or thirdbased on verbal discussions parties override the datawith MOCI officials, we
subject’s rights.
understand that theseshould be interpreted as
Sensitive information must
exemptions from thenot be processed unless theconsent requirement. This data subject has consented,
may be clarified in the next or it is necessary:
draft of the bill.
• To fulfil rights or
obligations under existinglaws and regulations.
• To protect the life andhealth of the data subject oranother person.
• To achieve the lawful andnon-commercial objectivesof public organisations.
• For purposes of medical
treatment, and adequatelevel of protection is
ensured.

Collection and notice
An organisation orCollection of data
Collection of data isagency must only
according to the New
defined as ‘to collectcollect personal
Zealand Privacy Act:
personal information in
information in aany form and way’. The
lawful and fair way. If
Personal information shallcollecting of data should practical, they mustnot be collected by any
be:collect theagency unless—• Respectful of the rights information from you(a) The information isand interests of the data personally and notcollected for a lawful
subject,from third parties. But purpose connected with a• Following ‘bona fide’,
there are situations
function or activity of the• Reasonable and fair, and where organisations
agency; and• Limited to the purpose and agencies are(b) The collection of theof collection.
allowed to collectinformation is necessary
On collecting data, theinformation about
for that purpose.
organisation is required to you from third
inform data subjects ofparties. For example:
Furthermore, the agency
the:collecting data from an• where you would• Organisation name,reasonably expect it individual will inform the• Purpose of data
data subject of the fact ofor where you’vecollection,collection, the intended
consented to your• Classification,
personal information use of the information and• Time, location, receiver
the recipients of thebeing sharedand uses of data,• a law enforcement information. The agency• Data subject’s rights, andagency may collect will also inform the data
• Consequences if they
personal information subject of their rights ofchoose not to provide theabout an individual access and correction.
personal information.
Agencies will not obtain
who is underinvestigation without information by illegal
Use and disclosureasking the individual means or to an
Lawful use of data differs
directly because to unreasonably intrusive
between government anddo so may jeopardise extent.
non-government agencies.
the investigation
In Taiwan, data processing • if a legal or official
An approved information
is defined as actions to
document mailed to sharing agreement may
record, input, store,
authorise an agency to
an individual iscompile, correct,
share any personal
returned to the
duplicate, retrieve, delete,
information with 1 orsender, then the
output, connect orsender may need to more other domestic
internally transmit
get the individual’s agencies in accordance
information to establish orwith the terms of thecurrent contact
use a personal information
details from another agreement.
file. Data use is defined assourceall personal information
use that is not covered
An entity can only use orunder processing (asdisclose personal
above).
information for a
Government or Nonpurpose for which it wasgovernment agencies must collected (known as thecomply with at least one ‘primary purpose’), orof the following clauses
for a secondary purpose
before processing
if an exception applies.
information:
The exceptions include• when in accordance with where:law;• the individual has• when the collection ofconsented to apersonal information issecondary use ornecessary for thedisclosure
government agency to• the individual would
perform its official duties
reasonably expect
or the non government
the entity to use oragency to fulfill the legal
disclose their
obligation;
personal information• when the notice will
for the secondary
impair the government
purpose, and thatagency in performing its
purpose is related to
official duties;
the primary purpose• when the notice willof collection, or, in
impair public interests.
the case of sensitive• when the Party should
information, directly
have known the content ofrelated to thethe notification already;primary purpose• when the collection of • the secondary use or
personal information is fordisclosure is required
non-profit purposes andor authorised by orclearly does not cause any
under an Australian
detriment to the Party.
law or a
court/tribunal order
Personal data may only be • a permitted generalused for the purpose of
situation exists incollection, unless accepted
relation to theby the PDPA.
secondary use or
disclosure(Also see #9 below –• the APP entity is anfurther about transferringorganisation and apersonal data to third
permitted healthparty)
situation exists inrelation to thesecondary use or
disclosure• the entity reasonably
believes that thesecondary use or
disclosure isreasonably necessary
for one or more
enforcement related
activities conducted

Page 9 of 14

EU / UKAPEC Privacy
Framework and theASEAN Framework

China

India

Hong Kong

Singapore

Malaysia

ThailandIndonesia

Philippines

VietnamJapan

TaiwanAustralia• For the protection of
lawful rights and interests ofindividuals.
•
Consent to the processing of
personal andsensitive information must
be freely given,
specific, informed, andevidenced by written,
electronic or recordedmeans.

New Zealandby, or on behalf of,an enforcement
body, orthe entity is anagency (other thanan enforcementbody) and discloses
biometric
information or
biometric templates
to an enforcement
body, and thedisclosure isconducted inaccordance withguidelines made by
the Information
Commissioner.

Ref:
https://www.oaic.gov.au/privacy/your-privacyrights/your-personalinformation/collectionof-personal-information/

Page 10 of 14

9.

Grounds for cross- Under GDPR, transfer is
APEC jurisdictions
border transfer of permitted if:
should endeavour topersonal data
• the country, territory or ensure that crossborder privacy rulesinternationalorganisation receiving and(e.g. consent,
recognition or
the personal data islegitimate
acceptancecovered by an EU
business,mechanisms facilitate
Commission's
compliance withresponsible and"adequacy decision";
applicable laws,• the transfer is subject to accountable crossoutsourcing)border data transfers
one of the below
and effective privacy"appropriate
safeguards" identified protections without
creating unnecessary
by the GDPR:
barriers to cross-bordera) a legally binding &information flows,
enforceable
instrument between including unnecessary
administrative andpublicauthorities/bodies; bureaucratic burdens
for businesses andb) Binding corporate
rules (for intra-group consumers.
transfers);c) Standard Contractual No restriction on crossClauses (approved by border data transfers
the EU Commission); but entities must
recognise the interestsd) Standard dataof individuals toprotection clauses
legitimate expectations
adopted by asupervisory authority of privacy under aand approved by the principle of preventing
harm. This is in
Commission (nosupervisory body has addition to the lawful
and fair requirements
yet adopted such(and notice andclauses);e) an approved code of consent whereappropriate). Notice
conduct;should include thef) an approved
identity and location ofcertification
personal information
mechanism; orcontrollers.
g) one of the‘derogations’ listed in
Under the ASEAN
Article 49 applies.
Framework, before
transferring personal
data to another country
or territory, theorganisation should
either obtain theconsent of theindividual for theoverseas transfer ortake reasonable steps
to ensure that thereceiving organisation
will protect thepersonal dataconsistently withthe framework. ASEAN
has proposed a draft
cross bordermechanism based on
certification andcontractual clauses.
The expectation is thatthe details of thismechanism will beworked out during
2020.
An ASEAN DataManagement
Framework (DMF) has
also been proposed
which will set
guidelines for how
companies handle thedata they hold.
Adhering to thesestandards may be aprecondition for data
flowing across borders.

Pre-approval on a per-transfereebasis

The PDP Bill permits the
cross-border transfer of
personal data in
Under the China Cyber Security Law, furtherance of thethe rules on cross-border data
purpose for which it wastransfer have not yet been finalized collected, assuming thatfor network operators in generalconsent was validly(excluding critical information
obtained from the Data
infrastructure operators).
Principal.
Please note that the draft Measuresfor Security Assessment for Crossborder Transfer of Personal Data
provide relevant obligations on the
network operator to submit the
proposed cross-border transfer of
personal data to CAC for security
assessment. It is likely that in near
future the cross-border transfer of
personal data by network operators
would also need to pass the security
assessment. Please note that the newdraft measures seem to favor theapproach of having a contractual
arrangement to ensure the overseas
data receiver must protect thepersonal data and facilitate theexercise of data subject rights. Somemandatory clauses have been
proposed for such cross-border datatransfer agreements, such as that the
network operator in China shall firstcompensate the data subject in theevent of infringement of the right todata protection by the overseas data
receiver, unless the network operator
can prove that it is not at fault.
While the new draft measures havenot been finalized, the network
operators in China may conduct thecross-border transfer of personal data
provided that self-assessment iscompleted and consent of data
subjects concerned is obtained.
Sectoral rules in the financial services
industry provide a general data
localization requirement on personal
financial data. Personal financial datathat is collected in China shall be
stored, processed and analysed in
China. The Banking financial
institutions are prohibited fromtransferring personal financial data
outside China unless relevant
conditions are met, i.e. (i) this crossborder data transfer is necessary forthe domestic financial institutions toprovide relevant cross-borderbusiness to the financial customers
and the authorization of the financial
customers is obtained; (ii) theoffshore data receivers are limited tocertain types of affiliated entities ofthe domestic financial institutions(i.e. it’s headquarter, parent
company, branch company,
subsidiary or other affiliated entities
that are necessarily needed for thecompletion of the cross-borderbusiness concerned); and (iii) thedomestic financial institutions shallrequest the offshore data receivers toprotect the transmitted personal
financial data by means of concluding
contract, conducting onsite
inspection and other sufficientmeasures.
Sectoral rules in the financial services
industry prohibit the banking financial
institutions from transferring client
identification materials andtransaction information that arecollected by the banking financial
institutions during the process of antimoney Laundering and counterterrorist financing to a place outside
China unless permitted by laws andadministrative regulations.

Consent and ensuring
equivalent protectionin third country
Section 33 of the PDPO
sets out restrictions on
cross-border transfers of
personal data but it is not
yet in force.

Same as domestictransfers, plus ensuring
equivalent protectionin third country.

Generally same as
domestic transfers, or
ensuring equivalent
protection in third
country.

Generally same as
domestic transfers.
Alternative methods not
yet finalized.

Obtain individual’s
An additional ground thatconsent for the disclosure PDPA requires thatcan be relied upon isof his personal data for a transfers of personal data
where the destination
specified purpose to an
overseas be conducted only country or internationaloverseas recipient unless it with the consent of theorganization that receives
Section 33 covers
is required under any law data subjects or wheresuch Personal Data hastransfers from Hong Kong or an exception under the such other exceptions
adequate data protection
to a place outside Hong
Fourth Schedule of theapply (e.g. where thestandards, and theKong and transfers
PDPA applies.
transfer is necessary for the transfer complies with
between two otherperformance of contract, or additional rules for thejurisdictions where thePursuant to a “transfer
where reasonable
protection of Personaltransfer is controlled by a limitation obligation”
precautions or due
Data to be prescribed byHong Kong data user.
under the PDPA,
diligence have been
the PDPC. However theorganisations transferring exercised to ensure thatPDPC has not yet
If and when section 33
personal data abroad must personal data will not beprescribed any such rules.
comes into effect, thedo so in accordance with processed in the recipienttransfer of personal data the requirements
jurisdiction in such manner Another ground for crossto places outside Hongprescribed under the PDPA which contravenes theborder transfers is anKong is prohibited unless to ensure that the
PDPA, etc.).
intragroup transfer whereat least one of therecipient provides asuitable protection
following conditions are standard of protection tomeasures which enable
met. The conditions are
personal data so
the enforcement of thethat:transferred that isdata subject’s rights,
comparable to theincluding effective legal
protection under the
remedial measures• the destination has
according to the rules andbeen approved by the PDPA.
methods as prescribed
Privacy Commissioner
One way to achieve this isand announced by thein writing;as follows:
Committee have been
• the data user has
provided by the Datareasonable grounds for •For inter-corporate
Controller or the Databelieving that the place transfers: data transfer
Processor. However thehas privacy laws which agreement
PDPC has not yet
are substantially similar • For intra-corporatetransfers:
bindingprescribed any rules.
to, or serve the same
purpose as, the PDPO; corporate rules• the individual has
consented in writing to
the transfer;• the data user has
reasonable grounds forbelieving that thetransfer is for the
avoidance or mitigationof adverse action
against the data
subject; it is notpracticable to obtain
the data subject's
consent but, if
practicable, suchconsent would begiven;• the data are exempt
from Data Protection
Principle 3 by virtue ofPart VIII of the PDPO
which exempts
personal data held forcertain purposes suchas domestic purposes,
employment or staff
planning, theprevention or detectionof crime, the security or
defence of Hong Kong,legal professional
privilege, news
activities etc;
• the data user has taken"all reasonableprecautions andexercised all due
diligence to ensure"that the data will not
be collected, held,
processed or used inany manner that would
constitute acontravention of the
PDPO if it occurred in
Hong Kong.
While section 33 has notcome into force, the PDPC
has mentioned that data
users should comply withthe good practicerecommendations statedin its guidance on crossborder transfer, being:• Reviewing any datatransfer arrangements

Notification andReporting

Cross-border Data
Transfer

There are no specificrestrictions on the crossborder transfer of
In addition to requirements Private Sector
personal information inapplicable to domestic
Before sharing data,
Vietnam. However, thetransfers, Regulation 20
controllers must obtain
Law on Cybersecurity
provides that cross border consent from the datarequires thattransfer of personal data
subject and provide details organizations must notmust be notified to theof the transfer including
share personal
MOCI. Such notification
relevant data, recipients and information to any thirdshould contain the following the data subject’s rights.
party, unless it is agreed
the minimum information: Consent is required evenby the individual orwhen the data is to berequested by competenta) name of the country of shared with an affiliate orstate bodies. There aredestination;
parent company, or similar no specific restrictions orb) name of the recipient; relationships. Data-sharing requirements in Vietnamc) date of transfer; andfor commercial purposes,
which apply to crossd) reason(s) or purpose(s) including direct marketing, is border transfers offor such transfer ofto be covered by a datapersonal information.
Personal Data.
sharing agreement, which
establishes adequate
Such notification should be safeguards for data privacy
notified to MOCI prior to the and security. The datatransfer of such data, andsharing agreement shall be
ESOs are to provide a report subject to review by theon the result of such
Commission, on its own
overseas transfer activity.
initiative or upon complaintof data subject.
Based on a no-name basis
informal consultation with Public sector
officials at MOCI, such
Data-sharing between
notification may be provided government agencies
once (i.e. at the beginning) pursuant to a public functionin the event that theor service shall be covered
transfer of Personal Data is by a data-sharing agreement
to be conducted on aguaranteeing complianceroutine basis (e.g., multiple with the Act, includingtransfers hourly, daily,
safeguards for data privacy
weekly etc.), assuming that and security. The datathe notification indicatessharing agreement shall bethat the transfer shall be
subject to review by the
conducted on a routine
Commission, on
basis. Officials at MOCI have its own initiative or upon
verbally confirmed on ancomplaint of data subject.
informal basis that a report
recording all such overseas
data transfers should be
provided to MOCI thereafter
on an annual basis for thepreceding 12 month periodalong with a plan for the
next 12 month period.

Personal information
Data transfer
Before an entity
The Privacy (Crossmust not be transferred
When disclosing to third discloses personal
Border Information
to a third party unlessparties, organisations are information to an
Amendment) Act 2010
consent has beenrequired to ensure theoverseas recipient,states that the Privacy
obtained from theprotection of personal
the entity must takeCommissioner may
principal or any one of
information. If information reasonable steps toprohibit cross-border
the above exceptions
is shared to third parties, ensure that thetransfer of personal
apply, as provided within
the organisation and third overseas recipient
information if:‘Collection and notice’.
party are both liable fordoes not breach the
Personal information may data breaches by the third Australian Privacy
1) The Commissioner
be transferred outside ofparty.
Principles in relationsuspects with reasonable
Japan where:
to the information.
grounds that the•Consent is obtained from If one of the followings has
information may be being
the principal.
occurred when the non- An entity that discloses 'routed' through New•The foreign state has
government agency
personal information to Zealand into a state where
privacy laws which aretransmits personalan overseas recipient is it will not be protected byconsidered equivalent to
informationaccountable for any acts substantial privacy
Japan.
internationally, theor practices of thelegislation;•The foreign party maintains government authority in overseas recipient in2) The transfer would
an internal personalcharge of subject industry relation to thecontravene the principles
information protection
may limit its action:
information that would of the Organisation forsystem consistent with
1. Where it involves major breach the Principles.
Economic Co-operation
standards set by the PPC.
national interests;
and Development
2. Where national treaty There are someGuidelines Governing theor agreement specifies
exceptions to theseProtection of Privacy andotherwise;
requirements in theTransborder Flows of
3. Where the country
Australian Privacy Act
Personal Data.
receiving personal
1988.
information lacks of
Proposal in the Privacy Bill
proper regulations
Ref:
2020 - Disclosing
towards the protection of https://www.oaic.gov.au information to an agency
personal information and /privacy/australianoverseas
it might harm the rights
privacy-principlesThe proposed IPP 12
and interests of the Party: guidelines/chapter-8(which is based on IPP
4.Where international
app-8-cross-border11(3) to (6) in the bill astransmission of personal disclosure-of-personal- introduced) sets out the
information is madeinformation/
principles for disclosure ofthrough an indirect
personal information
method in which theoutside New Zealand. In
provisions of this Law may
most cases, an agency thatnot be applicable.
wants to disclose personal
information to a foreign
Cross border transfer inperson or entity would
Taiwan is generally
need to satisfy at least one
permitted. There are noof the criteria set out indata transfer agreements.
our proposed IPP 12(1):Exceptions to this are• the individual concerned• Biological specimens in a
authorises the disclosure,biobank
after being expressly• International
informed by the agency
transmission of biobankthat the foreign person ordata must be approved byentity may not be required
the Ministry of Health andto protect the information
Welfarein a way that, overall,• Financial Supervisory
provides comparable
Commission approval issafeguards
required to outsource
to those in the billretail operations• the foreign person or• Telecommunications
entity is carrying on
providers cannot transfer
business in New Zealand,data to China
and the agency believes,on reasonable grounds,
that the foreign person orentity is subject to the bill
• the agency believes on
reasonable grounds thatthe foreign person orentity is subject to privacy
laws that, overall, provide
comparable safeguards tothose in the bill
• the agency believes on
reasonable grounds thatthe foreign person orentity is a participant in aprescribed binding scheme• the agency believes on
reasonable grounds thatthe foreign person orentity is subject to privacy
laws of a prescribedcountry• the agency otherwise
believes on reasonablegrounds that the foreign
person or entity must
protect the information in
a way that, overall,provides comparable
safeguards to those in thebill.
It is recommended toinclude the fourth
criterion as it is believedthat the new IPP 12 should
also allow for possible
future participation by
New Zealand in binding
cross-border privacy

Page 11 of 14

EU / UKAPEC Privacy
Framework and theASEAN Framework

China

India

Hong Kong• Control of cross-borderdata flow activities• Consider if any
exceptions to section
33 applies including
checking the White List
published by the PDPC
• Keep an inventory of
personal data beingtransferred outside ofHong Kong• Conduct regular audits
and inspections ontransferees' operations
to ascertain theircompliance with their
obligations under thedata transfer
agreement

Singapore

Malaysia

ThailandIndonesia

Philippines

VietnamJapan

TaiwanAustralia

New Zealandschemes. An example ofsuch a binding scheme is
the Asia Pacific Economic
Cooperation (APEC) CrossBorder Privacy Rules
system. Six out of the 21
APEC economies
participate in the system.
We recommend insertinga definition of “country”
into clause 6 which
includes a state, territory,
province, or any other partof a country.
Criteria for prescribing
binding schemes andcountries
It is recommended
inserting new clauses 212A
and 212B to provide forthe making of regulationsprescribing countries andbinding schemes for the
purposes of IPP 12, and to
set out the criteria that
the Minister must consider
before recommending thatsuch 6 Privacy Bill
Commentary regulations
be made. The Ministerwould be able torecommend that countries
or binding schemes beprescribed if satisfied that
personal information
would be subject toprivacy safeguards thatare, overall, comparable tothose in the bill.

Page 12 of 14

EU / UK
10.

APEC Privacy
Framework and theASEAN Framework

Additional
Under Article 9, special
N/A although notegrounds for
category data can onlythat given the generalcollection,
be processed if one theprinciples relating toprocessing, or
below conditions areproportionality,transfer ofsatisfied:businesses should
sensitive or critical • explicit consent has
take into account thatdata (either in the been given by the data more sensitive data
same jurisdictionneeds more
subject;or on a cross• processing is necessary: proportionate
border basis)
protection in terms ofa) for employment,
lawful and fair use,social security andsocial protection (if notice and protection
authorised by law); of legitimate
expectation ofb) to protect the vitalinterests of the data privacy.
subject or anotherperson;c) for establishment,
exercise or defenceof legal claims or
judicial acts;d) for reasons of
substantial public
interest (with a basis
in law);e) for the purposes ofhealth or social care(with a basis in law);f) for reasons of publichealth (with a basis inlaw); org) for archiving,
research andstatistics purposes(with a basis in law);• not-for-profit bodies;and• personal data madepublic by the data
subject.
Member States are alsoable to set additional
grounds for processing
special category innational legislation.

China

India

There have been a draft of measuresreleased by Cyberspace
Administration of China that
proposed filing requirement for thecollection of important data andsensitive personal data for businesspurpose.

Sensitive Personal Data
N/A
may be transferredoutside India with explicit
consent and (i) approved
intra-group schemes, (ii)permitted countries/
organisations, (iii) specifictransfer(s) based on
These draft measures also required necessity approved by
the publication, share, trade, or cross- the DPA.
border transfer of important data to
be subject to relevant security
As the definition of Sensitive
assessment and approval of
Personal Data includes
supervisory authorities.
financial data, a muchbroader subset of data forfinancial institutions will be
subject to explicit consent
for cross border transfers.
Currently, under the SPDI
Rules, the transfer of‘sensitive personal data or
information’ by a body
corporate is permissible if it
is necessary for the
performance of a lawful
contract or is affectedpursuant to the consent of
the provider of information.
A copy of such Sensitive
Personal Data is required to
be stored in India.
Critical Personal Data (thedefinition of which the DPA
may notify) shall only beprocessed and stored within
India.

Hong Kong

Singapore
N/A

Malaysia
N/A

Thailand
Explicit consent isgenerally needed forsensitive personal data.
Any collection / transferof ‘sensitive’ personal
data can be done without
the explicit consent fromthe data subject incertain cases, including
where:(a) it is necessary for theestablishment,compliance, exercise or
defense of legal claims;(b) it is necessary forcompliance with certain
laws on health,employment and othermatters as set out insection 26 of the PDPA.

Indonesia
Nothing additional to theabove.

Philippines
In the Implementing
Rules and Regulation of
the DPA, on Section 13:
Sensitive Personal
Information andPrivileged Information, it
states that The
processing of sensitive
personal and privileged
information is prohibited,
except in any of thefollowing cases:
a. Consent is given by data
subject, or by the parties tothe exchange of privileged
information, prior to theprocessing of the sensitive
personal information or
privileged information,
which shall be undertaken
pursuant to a declared,
specified, and legitimate
purpose;b. The processing of thesensitive personal
information or privileged
information is provided forby existing laws andregulations: Provided, thatsaid laws and regulations do
not require the consent of
the data subject for theprocessing, and guarantee
the protection of personaldata;
c. The processing isnecessary to protect the lifeand health of the data
subject or another person,
and the data subject is notlegally or physically able toexpress his or her consent
prior to the processing;d. The processing isnecessary to achieve thelawful and noncommercial
objectives of publicorganizations and theirassociations provided that:
1. Processing is confined andrelated to the bona fide
members of theseorganizations or theirassociations;2. The sensitive personal
information are nottransferred to third parties;
and3. Consent of the data
subject was obtained prior
to processing;e. The processing isnecessary for the purpose of
medical treatment:
Provided, that it is carriedout by a medical practitioner
or a medical treatment
institution, and an adequatelevel of protection of
personal data is ensured; orf. The processing concerns
sensitive personal
information or privileged
information necessary forthe protection of lawfulrights and interests ofnatural or legal persons incourt proceedings, or theestablishment, exercise, ordefense of legal claims, orwhen provided togovernment or publicauthority pursuant to a
constitutional or statutory
mandate.

Vietnam
None

Japan
N/A

TaiwanN/AAustralia
N/A

New Zealand
No Definition
None - 'sensitive or'critical' data is not adefined concept under the
NZ Privacy Act.
The Privacy Commissioner
may authorise thecollection, processing ortransfer of personal
information in breach of
the normal Privacy Act
principles if:(a) The public interest inthat collection or, as thecase requires, that use orthat disclosure outweighs,
to a substantial degree,
any interference with theprivacy of the individualthat could result from thatcollection or, as the caserequires, that use or that
disclosure; or(b) That collection or, as
the case requires, that use
or that disclosure involvesa clear benefit to theindividual concerned thatoutweighs any
interference with theprivacy of the individualthat could result from thatcollection or, as the caserequires, that use or that
disclosure.

Page 13 of 14

EU / UK
11.

Duplicative,
inconsistent or
supplementaryrules relating tocollection,
processing or
cross-bordertransfer or data
and/or othercomplexities

None

APEC Privacy
Framework and theASEAN Framework
N/A

China

India

The SFC issued a circular
on 31 October 2019(“Circular”) setting out
the regulatory
There is some duplication of rulerequirements for licensed
making by various ministries. In
corporations (“LCs”) whengeneral, the data protection rules
using electronic data
making is co-ordinated by Cyberspace RBI had released astorage providers
Administration of China and sectoral notification on 6 April 2018, (“EDSPs”). EDSPs include
regulators are also making rules inrequiring that all data
public and private cloudlight of these general principles as
relating to payment
services providers, as wellconsensus.
systems in India be located as external providers ofdata storage atsolely in India. The
conventional data centres
rationale which theor other forms of virtual
notification outlined wasstorage. The Circular"monitoring" andreminds LCs of their"unfettered supervisoryobligation to ensure theaccess". The notification
preservation and integrity
was succeeded byof those records or
stakeholders voicing
documents they areconcerns over compliance required to keep under
and technical challenges, all the Securities and Futuresof which required
Ordinance (“SFO”) andadditional clarity from the the Anti-Money
Laundering and CounterRBI. To this end, the RBI
published a set of FAQs on Terrorist Financing
Ordinance (“Regulatory
26 June 2019.
Records”). The Circularapplies to LCs who rely on
The FAQs permit processing
EDSPs either exclusivelyof financial data outside
or in conjunction with onIndia, provided (1) postsite data hosting.

Complexity across various laws andregulations; overlapping regulators

Not clear how rules
relating to “critical”“payment” or “sensitive”
data relating to financial
services will interact.

processing, the data isstored only in India(including end to end
transaction details), (2) thedata is moved to India anddeleted from any foreignsystems within 24 hours of
payment processing, (3) for
related processing activities(such as chargebacks),
remote access to data
located in India ispermitted.

Other

Hong Kong

Singapore
The PDPA provides thatthe provisions of otherwritten law prevail overportions of the PDPA tothe extent of any
inconsistency. E.g., MAS
Notice to Banks on
Prevention of Money
Laundering andCountering the
Financing of Terrorism(“MAS 626”) states thatin the course of
performing customer
due diligence incompliance with MAS
626, banks may berequired to collect, use
and disclose personal
data of individuals
without first obtaining
consent. In this case,MAS 626 will prevailover the requirement toobtain an individual’s
consent for thecollection, use or
disclosure of his
personal data for a
specified purpose under
the PDPA.

Unless the LC keeps its
The supplementary
Regulatory Records
simultaneously at its
regulations issued underapproved premises in Hong the PDPA are:Kong, the LC needs to comply • Personal Datawith Sections C, D and E ofProtection (Composition
the Circular. All LCs that useof Offences) Regulations
EDSPs, regardless of whether
2013
Regulatory Records are kept
• Personal Data
exclusively with an EDSP,
must comply with Section E Protection (Do Not Call
Registry) Regulationsof the Circular (General2013
obligations of LCs using• Personal Data
external data storage orprocessing services).
Protection

Given that there is likely tobe an overlap between(Enforcement)
payment data which the RBI If the EDSP is a Hong Kong
Regulations 2014
EDSP,
the
LC
is
requiredtoseeks to localise, and• Personal Data
issue a notice (“Notice”) to
Sensitive Personal Data as
Protection Regulations
the EDSP authorising thedefined in the PDP Bill,2014
EDSP to provide thethere is likely to be a
Regulatory Records of the LC • Personal Data
conflict between theProtection (Appeal)to the SFC.
localisation mandated byRegulations 2015
the RBI and the transfers
If the EDSP is a non-Hongpermitted by the PDP Bill
Kong based entity, it must
provide an undertaking
insofar as such ‘payment(“Undertaking”) to provide
data’ relates to natural
Regulatory Records andpersons.
assistance as may berequired by the SFC. TheEDSP would be consenting toassisting the SFC in exercising
its statutory powers despite
the fact that the EDSP is anoffshore entity. The LC is also
required to issue the Noticeto the EDSP.
The rationale behind theUndertaking and Notice is toempower the SFC to be able
to promptly access the LC’s
Regulatory Records without
undue delay, and to be sureof the authenticity, integrity
and reliability of theRegulatory Records. The SFC
also indicated in its Circularthat the production of theserecords may be required to
be produced in legal
proceedings initiated by the
SFC or the Department ofJustice in Hong Kong.

Malaysia
The Anti-Money
Laundering, AntiTerrorism Financing andProceeds of Unlawful
Activities Act 2001(“AMLAATFA”) stipulates
that any secrecy
obligations imposed by
any written law areoverridden by thereporting obligations
under the AMLAATFA on
reporting institutions
such as licensed banks.
The subsidiary legislation
to the PDPA are the
Personal Data Protection
Regulations 2013,
Personal Data Protection(Registration of Data
User) Regulations 2013,
Personal Data Protection(Class of Data Users)
Order 2013, Personal
Data Protection (Fees)
Regulations 2013,
Personal Data Protection(Compounding of
Offences) Regulations
2016 and Personal Data
Protection Standard
2015.

ThailandIn the event that there is
any sector-specific law
governing the protectionof Personal Data in any
manner, any business or
any entity, the provisionsof such law should
prevail, except for:1.

2.
1. in relation tocollection, use, ordisclosure of PersonalData,
2. the provisions withrespect to the rights ofdata subjects including
relevant penalties,
3. where the PDPA’s
expert committee has
powers to protect data
subjects which are
greater than analogous
powers provided toauthorities in otherlegislation,
In which case the PDPA
can supersede the othersector-specific law.

3.

Indonesia

Philippines

The implementationand enforcement of
the extraterritorial
principle is difficult inpractice. We have notseen any real-world
examples to date.

The supplementary
regulations issued under
the Philippines DPA are:Vietnam
Considerations:Japan

Some other laws are
None
restricting personal data
• Increased priority for cyber sharing with external
security. In 2018, Vietnam third parties without• NPC Circular 16-01 –enacted the Law onconsent. (e.g.
Security of Personal Data in Cybersecurity
Employment security law:
Government Agencies(24/2018/QH14), which
6. http://www.japanesel
increases the power granted
awtranslation.go.jp/laGR 71 is recently• NPC Circular 16-02 – Data to the State to investigate
w/detail_main?id=10
issued and as such the Sharing Agreements
users and censor content&vm=&re= )implementing
Involving Government
published online byregulations of the GR Agencies
individuals.
71 will be issued toprovide more detail• NPC Circular 16-03• Data localisation. The NIS
on how to implement – Personal Data Breach
Law establishes stricter
the obligations set out Management
requirements for foreign
under GR 71
service providers operating• NPC Circular 16-04 – Rules in Vietnam, including data
Please see possibleof Procedure
localisation in certain
different
circumstances.
implementation of GR • NPC Circular 17-01 –Businesses that collect and
71 in practice inRegistration of Data
process the personal data ofrelation to the ability Processing Systems
Vietnamese citizens are
to process personalrequired to maintain adata based on other• NPC Circular 17-01
physical office and store thereasons as set out inAppendix 1 – Registration of data in Vietnam.
item 1 to 6 in the
Data Processing Systems
response of item 8
Appendix 1
Data protection rules can
without consent.
also be found in the• NPC Circular 18-01 – Rules following sectoral laws, asof procedure on requests for amended:
Advisory Opinions• Decree on E-commerce• NPC Circular 18-02 –(52/2013/ND-CP).
Guidelines on Compliance
Organisations andChecksindividuals conducting
part or the whole of the• NPC Circular 18-03 – Rules process of commercial
on Mediation before theactivity by electronic
National Privacy Commission means connected to the4.
internet, mobile
telecommunications
network or other open
networks• Law on CyberSecurity(24/2018/QH14).
Vietnamese and foreign
enterprises which provide
services on telecom
networks and on theinternet and other value
added services incyberspace, in Vietnam• Law on Information
Technology(67/2006/QH11).
Vietnamese and foreignorganisations andindividuals engaged in
information technology
application anddevelopment activities inVietnam.
5.

TaiwanAustralia
None

New ZealandNone found.
The New Zealand Privacy
Act 2020 will most likely
be passed by its
parliament later in 2020,
and will amend thePrivacy Act 1993.
However, the proposed
amendments do notpresent rules that
duplicate or conflict withpresent legislation.

Law on Network
Information Security(86/2015/QH1x3). Any
Vietnamese agencies
organisation,individual; foreignorganisation andindividual in Vietnam
who directly involves
in or is related to
network information
security activities inVietnam.

There are also requirements
on LCs to ensure that aproper audit trail exists
regarding any access to theRegulatory Records whenstored with their EDSP. LCs
also need to designate two
managers-in-charge thatwould be based in Hong
Kong (who would be theresponsible point of contact
for the SFC).

Page 14 of 14