MARKET FAQ

Even if a single data point cannot identify an individual, it may still be considered personal data if you have access to other data which, in combination with that data point, allows you to identify the individual. If you are collecting multiple data points from an individual, it is possible that this will constitute collection of personal data.

1. Under the Personal Data Protection Act 2012 ("PDPA"), "personal data" is defined broadly as "data, whether true or not, about an individual who can be identified from that data, or from that data and other information to which the organisation has or is likely to have access." 2. The Personal Data Protection Commission's ("PDPC") Advisory Guidelines on Selected Topics further note that the more data points an organisation collects with a unique identifier (such as an IP address, cookies or device ID), the more likely it is that the data will constitute personal data even if the individual's name is not included.

1. To mitigate any PDPA-related risk arising from this, include a pop-up window on your Singapore website to inform users of your cookie policy and the data points that will be collected from them. 2. If any of these cookies are not strictly necessary for the users to browse your website, the users should be allowed to disable these cookies if they wish to. 3. Users should be asked to acknowledge and consent to the cookie policy, and/or configure which cookies are allowed, before they are allowed to continue browsing the website.

As the Singapore branch will be transferring personal data to a recipient outside Singapore (even if the recipient is its Taiwan head office), the Transfer Limitation Obligation of the Personal Data Protection Act 2012 ("PDPA") will apply. As the transfer of personal data to Taiwan constitutes use or disclosure of the customers' personal data, consent should be sought from customers.

1. Essentially, the Transfer Limitation Obligation requires you to comply with certain statutory requirements before you transfer personal data to a recipient outside Singapore. 2. In particular, you must take appropriate steps to ascertain whether, and to ensure that, the Taiwan head office will protect the transferred personal data to a standard that is at least comparable to the PDPA.

1. To fulfil this requirement, the Singapore branch may enter into a contract with its Taiwan head office that requires the Taiwan head office to protect the transferred personal data to a standard that is at least comparable to the PDPA, and specifies the countries and territories to which the personal data may be transferred under the contract. 2. Alternatively, the company may sign up to binding corporate rules that meet these requirements and other specified requirements under the PDPA. 3. To obtain the requisite consent, indicate in your customer-facing privacy policy that customers' personal data may be sent to your Taiwan head office. 4. Customers should be asked to review and agree to the terms of the privacy policy before they provide their personal data.

A direct translation of the Privacy Policy is unlikely to be sufficient. Compliance with Taiwan's Personal Data Protection Act does not, by default, establish compliance with Singapore's Personal Data Protection Act 2012 ("PDPA").

While there may be some structural similarities between Taiwan's Personal Data Protection Act and Singapore's PDPA, there are differences in the obligations and requirements.

1. The Taiwan Privacy Policy may be used as a starting point but should be reviewed and adapted to ensure it complies with the requirements of Singapore's PDPA. 2. In particular, the policy should be checked to ensure that it adequately describes the purposes for which personal data are collected, used and disclosed, the organisation's consent practices, any overseas data transfers, users' rights, and data retention periods. 3. In addition to updating the Privacy Policy for use in Singapore, it is also prudent to separately review your internal policies, procedures and safeguards to ensure that they are appropriate for your Singapore operations.

Under Singapore's Personal Data Protection Act 2012 ("PDPA"), an organisation that collects, uses or discloses personal data in Singapore must comply with various data protection obligations. Before you begin acquiring personal data for your Singapore operations, there are several matters that should be worked through.

1. The purposes for which personal data is collected, used or disclosed must be reasonable and, where required, notified to the relevant individuals. 2. For completeness, the full list of PDPA obligations is set out below: Accountability Obligation: Undertake measures to ensure that organisations meet their obligations under the PDPA such as making information about your data protection policies, practices and complaints process available upon request and designating a data protection officer (DPO) and making the business contact information available to the public. Notification Obligation: Notify individuals of the purposes for which your organisation is intending to collect, use or disclose their personal data. Consent Obligation: Only collect, use or disclose personal data for purposes which an individual has given his/her consent to. Purpose Limitation: Only collect, use or disclose personal data for the purposes that a reasonable person would consider appropriate under the given circumstances and for which the individual has given consent. Accuracy Obligation: Make a reasonable effort to ensure that the personal data collected is accurate and complete, especially if it is likely to be used to make a decision that affects the individual or to be disclosed to another organisation. Protection Obligation: Reasonable security arrangements must be made to protect the personal data in your organisation’s possession to prevent unauthorised access, collection, use, disclosure or similar risks. Retention Limitation Obligation: Cease retention of personal data or dispose of it in a proper manner when it is no longer needed for any business or legal purpose. Transfer Limitation Obligation: Do not transfer personal data to another country except in accordance with requirements prescribed under the PDPA regulations. This includes ensuring that the overseas recipient will provide a standard of protection to the transferred personal data that is comparable to the protection under the PDPA. Access and Correction Obligation: Upon request, (i) provide individuals with access to their personal data as well as information about how the data was used or disclosed within a year before the request, and (ii) allow individuals to correct an error or omission in their personal data. Data Breach Notification Obligation: In the event of a data breach, take steps to assess if the breach is notifiable. If the data breach is likely to result in significant harm to individuals, and/or is of significant scale, notify the Personal Data Protection Commission ("PDPC") and the affected individuals as soon as practicable. Data Portability Obligation (Not currently in force): At the request of the individual, transmit the individual’s data to another organisation in a commonly used machine-readable format.

1. You should determine what personal data you will collect, the purposes for which you will collect and use it, and whether and to whom you will disclose it. 2. As the PDPA operates on a consent-based regime, you should also determine whether consent is required for the proposed collection, use or disclosure, or whether there is another legal basis under the PDPA which allows you to collect, use or disclose the personal data without consent. 3. Go through the eleven obligations listed under Why it matters, one by one, and confirm that your company has a corresponding practice in place before it starts acquiring data on Singapore users.

The Personal Data Protection Commission ("PDPC") has clarified that an organisation is not required to specify every individual activity that it may undertake in relation to personal data. Rather, it should state its objectives or reasons for collecting, using or disclosing the personal data at an appropriate level of detail. The stated purposes should be sufficiently clear and specific to enable an individual to understand why, and in what circumstances, their personal data will be collected, used or disclosed.

1. Under section 18 of the Personal Data Protection Act 2012 ("PDPA"), personal data is to be collected, used, or disclosed only for purposes that a reasonable person would consider appropriate in the circumstances. 2. In this case, the phrase suggests that you will use customers' personal data to improve the quality of your services and the customers' experience. 3. Ultimately, the goal is to ensure that individuals understand for what purposes their personal data are being used.

1. In determining the appropriate level of specificity, you should consider: whether the purpose is stated clearly and concisely; whether the purpose is required for the provision of products or services (as distinct from optional purposes); if the personal data will be disclosed to other organisations, how the organisations should be made known to the individuals; whether stating the purpose to a greater degree of specificity would be a help or hindrance to the individual understanding the purpose(s) for which their personal data would be collected, used or disclosed; and what degree of specificity would be appropriate in light of your business processes. 2. However, if you intend to use the personal data for specific purposes beyond this, those purposes should be described with greater specificity.

Under the Personal Data Protection Act 2012 ("PDPA"), an individual has rights to request access to, and correction of, their personal data that is held by you. If you do not handle the individual's request in accordance with the PDPA, the individual may file a complaint with the Personal Data Protection Commission ("PDPC").

1. The PDPC has powers to review complaints and investigate potential breaches of the PDPA. 2. Following its review, the PDPC may issue directions to ensure compliance, and may also impose financial penalties. 3. The PDPA also provides for a right of private action in certain circumstances, which allows an individual to bring civil proceedings if they have suffered loss or damage directly as a result of your breach of the PDPA.

1. You must generally respond to a valid access or correction request in accordance with sections 21 and 22 of the PDPA, unless an exception applies. 2. Access request: Under section 21(6) of the PDPA, if your organisation rejects an access request, you must provide a reply to the individual informing them of the reasons for the rejection. 3. Correction request: Under section 22(5) of the PDPA, if no correction is made, you must annotate the individual's personal data with the correction that was requested but not made. 4. When you receive a request to stop using the data, handle it under section 16 of the PDPA: (1) Under section 16(1), the individual may withdraw consent at any time on giving reasonable notice to your company. (2) Under section 16(2), on receiving the notice your company must inform the individual of the likely consequences of withdrawing consent. (3) Under section 16(4), your company must cease collecting, using or disclosing the individual's personal data, and cause its data intermediaries and agents to cease, unless collection, use or disclosure without consent is required or authorised under the PDPA or other written law.

Yes, the Personal Data Protection Act 2012 ("PDPA") applies to all organisations that collect, use or disclose personal data in Singapore, regardless of whether they are formed or recognised under Singapore law or whether they are resident or have an office or place of business in Singapore.

1. Overseas organisations that gather data from users in Singapore must comply with the PDPA. 2. The Advisory Guidelines on Key Concepts in the PDPA issued by the Personal Data Protection Commission (PDPC) explain that an “organisation” under the PDPA includes not only companies but also individuals and associations or bodies of persons. Whether or not they are formed or recognised under Singapore law, are resident in Singapore, or have an office or place of business there, they must comply with the PDPA when they collect, use or disclose personal data in Singapore, unless they fall within an excluded category.

1. Check whether your company’s website or service collects personal data from users in Singapore. Data without a name still count as personal data if, combined with other data, they can identify a person (see Q1 of this column). 2. If it does, the PDPA obligations generally apply to your company in full (see Q4 of this column for each one). In particular, under section 11(3) and (5) of the PDPA, you must designate at least one individual to be responsible for ensuring that the company complies with the PDPA, and make the business contact information of at least one of those individuals available to the public. 3. Review and revise your privacy policy against the PDPA’s requirements; do not simply translate the Taiwanese version (see Q3 of this column).

Assuming the Manila team is engaged to process personal data on behalf of your organisation and for the organisation's purposes, it will be regarded as a "data intermediary" under the Personal Data Protection Act 2012 ("PDPA"). Under section 4(3) of the PDPA, your organisation has the same obligations under the PDPA in respect of personal data processed on its behalf by a data intermediary as if the personal data were processed by your organisation.

1. A data intermediary is an organisation that processes personal data on behalf of another organisation. 2. As the Manila team is based overseas, your organisation is responsible for complying with the Transfer Limitation Obligation in respect of the personal data transferred to the Manila team. 3. You must ensure that personal data transferred to the Manila team is protected to a standard comparable to the protection required under the PDPA.

1. Accordingly, you should put measures in place to ensure that the Manila team is able to process personal data in a PDPA-compliant manner. This may include: Establishing the objectives and requirements of the customer support to be outsourced; Having a binding contractual agreement that sets out the scope of the outsourcing and the Manila team's obligations when processing personal data; Ensuring that the Manila team only accesses and processes personal data to the extent necessary to provide the outsourced customer-support services and for the purposes for which the personal data was collected; Putting in place appropriate controls to address matters such as access to personal data, security measures, retention and deletion, use of subcontractors, and the deletion of personal data where appropriate; Including contractual provisions requiring the Manila team to notify your organisation of data breaches without undue delay (which is a requirement under the PDPA); Ensuring that the Manila team is able to meet the requirements of the PDPA and has the necessary data protection framework; Proactive monitoring, conducting audit exercises and on-site inspections to ensure compliance; and Establishing exit management plans and time frames for the Manila team to cease retaining personal data after the outsourcing ceases. 2. To comply with the Transfer Limitation Obligation, undertake appropriate due diligence and obtain assurances that the Manila team has appropriate policies, practices and safeguards in place to protect the personal data.