PDPA<\/h1><\/div>Personal Data Protection Act<\/p>\n<\/div>
The ASEAN Framework on Personal Data Protection, established in 2016, harmonizes data protection standards in the APAC region.<\/p>\n<\/div><\/div><\/div>
![\"Header](\"https:\/\/www.arcadsoftware.com\/dot\/wp-content\/uploads\/2024\/01\/illustration-header-pdpa-dot.png\" "\\"illustration-header-pdpa-dot\\"")
<\/span><\/div><\/div><\/div><\/div><\/div>The ASEAN Framework<\/h2><\/div><\/div><\/div>The ASEAN Framework on Personal Data Protection<\/b> is a regional initiative in the APAC region, aimed at harmonizing data protection standards across Southeast Asia. While it doesn’t establish a binding law like the European Union’s General Data Protection Regulation (GDPR)<\/a><\/b>, it serves as a guiding framework to encourage member states to develop and strengthen their data protection laws and practices. This cooperative agreement facilitates digital trade and information flow, respecting the framework’s principles. It emphasizes personal data protection, cooperation among members, free information flow, and maintains confidentiality. Amendments require mutual agreement.<\/p>\nThe framework, established in 2016,<\/b> provides broad principles for data governance, complemented by the 2018 ASEAN Framework on Digital Data Governance and has also a major role to play in reinforcing defenses against cyber-attacks, including Ransomware, through strict data management practices.<\/p>\n<\/div><\/div><\/div><\/div><\/div>![\"Picto](\"https:\/\/www.arcadsoftware.com\/dot\/wp-content\/uploads\/2024\/01\/illustration-picto-differences-apac-pdpa.png\" "\\"illustration-picto-differences-apac-pdpa\\"")
<\/span><\/div>Differences between APAC countries<\/h2><\/div><\/div><\/div>Let\u2019s focus on the data protection laws<\/b> of certain countries (Singapore, Malaysia, the Philippines, Thailand, Vietnam and Indonesia) in the ASEAN<\/b>. Differences can be observed between some countries leading the way by taking inspiration from the GDPR in 2018, and others being a little further behind regarding this matter.<\/p>\n<\/div><\/div><\/div><\/i><\/i><\/span>Singapore<\/span><\/a><\/h4><\/div>The Singapore Parliament passed the Personal Data Protection (Amendment) Bill 2020<\/b>, introducing significant updates to the PDPA overseen by the Personal Data Protection Commission (PDPC)<\/b>, improving the flow of data between service providers, and giving consumers more control over their data. It came into effect in phases on February 1, 2021. This includes mandatory data breach notifications and consent provisions<\/b>. Yet to be implemented is the Data Portability Obligation.<\/p>\nMajor amendments effective from February 2021 include increased financial penalties and provisions against dictionary attacks and address harvesting software. Penalties for non-compliance include a maximum financial penalty of 10% of an organization’s annual turnover in Singapore if it exceeds S$10 million<\/b>, applicable after October 1, 2022, or S$1 million otherwise.<\/b><\/div><\/div><\/div><\/i><\/i><\/span>Malaysia<\/span><\/a><\/h4><\/div>Following a 2020 public consultation, Malaysia presented amendments to its Personal Data Protection Act 2010 (\u201cPDPA\u201d)<\/b> in Parliament in October 2022. These changes introduce new obligations for data users and processors. Key amendments include mandatory data breach reporting, data protection officer appointments, and specific duties for data processors. The proposals aim to enhance data protection standards, aligning with global practices, and requiring businesses to adapt to new compliance responsibilities.<\/b><\/p>\nIn January 2023, Communications and Digital Minister of Malaysia Fahmi Fadzil mentioned that the Personal Data Protection Department (\u201cJDPD\u201d)<\/b> is refining the amendments with additional aspects for improved applicability. A key change includes mandatory breach notifications by companies to JPDP. Fahmi highlighted the need for increased fines for data misuse, noting the inadequacy of current penalties with an average fine of RM24,000 per company since 2017<\/b>.<\/div><\/div><\/div><\/i><\/i><\/span>Philippines<\/span><\/a><\/h4><\/div>The National Privacy Commission is actively promoting adherence to data privacy standards across various sectors in the Philippines. To align with the stringent standards and requirements of the EU GDPR, the Philippine Data Privacy Act of 2012 has been enhanced with rules and regulations that reflect EU GDPR principles.<\/b> The corresponding implementing rules and regulations (IRR)<\/b> of the DPA Law was issued in 2016.<\/p>\nThe Philippines’ National Privacy Commission issued Circular No. 2022-01, effective August 27, 2022, introducing fines for Data Privacy Act breaches. Fines vary based on the severity of infraction, with a maximum cap of PHP 5 million for grave violations<\/b>. The circular ensures due process before imposing fines, and non-payment may result in legal consequences.<\/div><\/div><\/div><\/i><\/i><\/span>Indonesia<\/span><\/a><\/h4><\/div>
\nIndonesia’s new Personal Data Protection Law (PDP Law), Law No. 27 Year 2022,<\/b> was enacted on 17 October 2022, marking significant progress in personal data protection. This global law offers more comprehensive and integrated protection than previous, fragmented regulations. It applies to individuals, corporations, public entities, and international organizations within Indonesia, and affects foreign entities if legal impacts occur in Indonesia or involve Indonesian citizens.<\/p>\nIn Indonesia, the Personal Data Protection Law imposes criminal sanctions for unauthorized data activities with penalties of up to 6 years imprisonment and fines up to IDR 6 billion.<\/b> Corporations may face tenfold higher fines and additional consequences like dissolution. Administrative sanctions include warnings, suspensions, and fines.<\/div><\/div><\/div><\/i><\/i><\/span>Thailand<\/span><\/a><\/h4><\/div>
\nThailand’s Personal Data Protection Act 2019 (PDPA)<\/b> has been delayed until May 31, 2022, due to COVID-19. The PDPA establishes the Personal Data Protection Committee (PDPC)<\/b> for regulatory guidance and includes key data subject rights, such as access, rectification, protection of personal data, etc. Organizations must appoint a Data Protection Officer (DPO)<\/b>, implement data subject request processes, monitor data risks, optimize data collection, document breaches, control third-party access to data, approve a data protection plan and keep up-to-date with regulatory changes.<\/p>\nIn Thailand, non-compliance with the Personal Data Protection Act 2019 (PDPA) can result in civil actions for damages, criminal penalties including fines and imprisonment<\/b> for abusive use of data, and administrative fines of up to five million baht for violations <\/b>such as unauthorized data processing or failure to notify data breaches.<\/div><\/div><\/div><\/i><\/i><\/span>Vietnam<\/span><\/a><\/h4><\/div>The Vietnamese government passed Decree No. 13\/2023\/ND-CP on Personal Data Protection (Decree 13) <\/b>on April 17, 2023, consolidating Vietnam’s data protection regulations. Effective July 1, 2023, it applies to entities within Vietnam and those processing data related to Vietnamese individuals or activities. Decree 13 aligns with global data privacy trends, resembling aspects of the European GDPR, and emphasizes the importance of data privacy in Vietnam<\/b>. Businesses must prepare for compliance, particularly concerning cross-border data transfers and data subject rights management.<\/p>\nIn Vietnam, non-compliance with the Data Privacy Law can lead to varying penalties. Failing to obtain consent for data collection may result in fines up to $850<\/b>, while improper use of data can incur fines around $2,560<\/b>. Additionally, violations of data safety and confidentiality rules can attract criminal sanctions, including warnings, fines, and prison sentences up to 3 years.
\n<\/b><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>Anonymize your data with DOT Anonymizer!<\/h2><\/div><\/div><\/div>Discover DOT Anonymizer<\/span>Discover DOT Anonymizer<\/span><\/div><\/a><\/div><\/div><\/div><\/div><\/div>![\"APAC](\"https:\/\/www.arcadsoftware.com\/dot\/wp-content\/uploads\/2024\/01\/illustration-apac-data-leakage-pdpa.png\" "\\"illustration-apac-data-leakage-pdpa\\"")
<\/span><\/div>How to eliminate the risk of data leaks, and why an in-house solution is not always the best solution?<\/h2><\/div><\/div><\/div>
Personal Data Protection Act<\/p>\n<\/div>
The ASEAN Framework on Personal Data Protection, established in 2016, harmonizes data protection standards in the APAC region.<\/p>\n<\/div><\/div><\/div>
<\/span><\/div><\/div><\/div><\/div><\/div>The ASEAN Framework<\/h2><\/div><\/div><\/div>The ASEAN Framework on Personal Data Protection<\/b> is a regional initiative in the APAC region, aimed at harmonizing data protection standards across Southeast Asia. While it doesn’t establish a binding law like the European Union’s General Data Protection Regulation (GDPR)<\/a><\/b>, it serves as a guiding framework to encourage member states to develop and strengthen their data protection laws and practices. This cooperative agreement facilitates digital trade and information flow, respecting the framework’s principles. It emphasizes personal data protection, cooperation among members, free information flow, and maintains confidentiality. Amendments require mutual agreement.<\/p>\nThe framework, established in 2016,<\/b> provides broad principles for data governance, complemented by the 2018 ASEAN Framework on Digital Data Governance and has also a major role to play in reinforcing defenses against cyber-attacks, including Ransomware, through strict data management practices.<\/p>\n<\/div><\/div><\/div><\/div><\/div><\/span><\/div>Differences between APAC countries<\/h2><\/div><\/div><\/div>Let\u2019s focus on the data protection laws<\/b> of certain countries (Singapore, Malaysia, the Philippines, Thailand, Vietnam and Indonesia) in the ASEAN<\/b>. Differences can be observed between some countries leading the way by taking inspiration from the GDPR in 2018, and others being a little further behind regarding this matter.<\/p>\n<\/div><\/div><\/div><\/i><\/i><\/span>Singapore<\/span><\/a><\/h4><\/div>The Singapore Parliament passed the Personal Data Protection (Amendment) Bill 2020<\/b>, introducing significant updates to the PDPA overseen by the Personal Data Protection Commission (PDPC)<\/b>, improving the flow of data between service providers, and giving consumers more control over their data. It came into effect in phases on February 1, 2021. This includes mandatory data breach notifications and consent provisions<\/b>. Yet to be implemented is the Data Portability Obligation.<\/p>\nMajor amendments effective from February 2021 include increased financial penalties and provisions against dictionary attacks and address harvesting software. Penalties for non-compliance include a maximum financial penalty of 10% of an organization’s annual turnover in Singapore if it exceeds S$10 million<\/b>, applicable after October 1, 2022, or S$1 million otherwise.<\/b><\/div><\/div><\/div><\/i><\/i><\/span>Malaysia<\/span><\/a><\/h4><\/div>Following a 2020 public consultation, Malaysia presented amendments to its Personal Data Protection Act 2010 (\u201cPDPA\u201d)<\/b> in Parliament in October 2022. These changes introduce new obligations for data users and processors. Key amendments include mandatory data breach reporting, data protection officer appointments, and specific duties for data processors. The proposals aim to enhance data protection standards, aligning with global practices, and requiring businesses to adapt to new compliance responsibilities.<\/b><\/p>\nIn January 2023, Communications and Digital Minister of Malaysia Fahmi Fadzil mentioned that the Personal Data Protection Department (\u201cJDPD\u201d)<\/b> is refining the amendments with additional aspects for improved applicability. A key change includes mandatory breach notifications by companies to JPDP. Fahmi highlighted the need for increased fines for data misuse, noting the inadequacy of current penalties with an average fine of RM24,000 per company since 2017<\/b>.<\/div><\/div><\/div><\/i><\/i><\/span>Philippines<\/span><\/a><\/h4><\/div>The National Privacy Commission is actively promoting adherence to data privacy standards across various sectors in the Philippines. To align with the stringent standards and requirements of the EU GDPR, the Philippine Data Privacy Act of 2012 has been enhanced with rules and regulations that reflect EU GDPR principles.<\/b> The corresponding implementing rules and regulations (IRR)<\/b> of the DPA Law was issued in 2016.<\/p>\nThe Philippines’ National Privacy Commission issued Circular No. 2022-01, effective August 27, 2022, introducing fines for Data Privacy Act breaches. Fines vary based on the severity of infraction, with a maximum cap of PHP 5 million for grave violations<\/b>. The circular ensures due process before imposing fines, and non-payment may result in legal consequences.<\/div><\/div><\/div><\/i><\/i><\/span>Indonesia<\/span><\/a><\/h4><\/div>
\nIndonesia’s new Personal Data Protection Law (PDP Law), Law No. 27 Year 2022,<\/b> was enacted on 17 October 2022, marking significant progress in personal data protection. This global law offers more comprehensive and integrated protection than previous, fragmented regulations. It applies to individuals, corporations, public entities, and international organizations within Indonesia, and affects foreign entities if legal impacts occur in Indonesia or involve Indonesian citizens.<\/p>\nIn Indonesia, the Personal Data Protection Law imposes criminal sanctions for unauthorized data activities with penalties of up to 6 years imprisonment and fines up to IDR 6 billion.<\/b> Corporations may face tenfold higher fines and additional consequences like dissolution. Administrative sanctions include warnings, suspensions, and fines.<\/div><\/div><\/div><\/i><\/i><\/span>Thailand<\/span><\/a><\/h4><\/div>
\nThailand’s Personal Data Protection Act 2019 (PDPA)<\/b> has been delayed until May 31, 2022, due to COVID-19. The PDPA establishes the Personal Data Protection Committee (PDPC)<\/b> for regulatory guidance and includes key data subject rights, such as access, rectification, protection of personal data, etc. Organizations must appoint a Data Protection Officer (DPO)<\/b>, implement data subject request processes, monitor data risks, optimize data collection, document breaches, control third-party access to data, approve a data protection plan and keep up-to-date with regulatory changes.<\/p>\nIn Thailand, non-compliance with the Personal Data Protection Act 2019 (PDPA) can result in civil actions for damages, criminal penalties including fines and imprisonment<\/b> for abusive use of data, and administrative fines of up to five million baht for violations <\/b>such as unauthorized data processing or failure to notify data breaches.<\/div><\/div><\/div><\/i><\/i><\/span>Vietnam<\/span><\/a><\/h4><\/div>The Vietnamese government passed Decree No. 13\/2023\/ND-CP on Personal Data Protection (Decree 13) <\/b>on April 17, 2023, consolidating Vietnam’s data protection regulations. Effective July 1, 2023, it applies to entities within Vietnam and those processing data related to Vietnamese individuals or activities. Decree 13 aligns with global data privacy trends, resembling aspects of the European GDPR, and emphasizes the importance of data privacy in Vietnam<\/b>. Businesses must prepare for compliance, particularly concerning cross-border data transfers and data subject rights management.<\/p>\nIn Vietnam, non-compliance with the Data Privacy Law can lead to varying penalties. Failing to obtain consent for data collection may result in fines up to $850<\/b>, while improper use of data can incur fines around $2,560<\/b>. Additionally, violations of data safety and confidentiality rules can attract criminal sanctions, including warnings, fines, and prison sentences up to 3 years.
\n<\/b><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>Anonymize your data with DOT Anonymizer!<\/h2><\/div><\/div><\/div>Discover DOT Anonymizer<\/span>Discover DOT Anonymizer<\/span><\/div><\/a><\/div><\/div><\/div><\/div><\/div><\/span><\/div>How to eliminate the risk of data leaks, and why an in-house solution is not always the best solution?<\/h2><\/div><\/div><\/div>
The ASEAN Framework on Personal Data Protection<\/b> is a regional initiative in the APAC region, aimed at harmonizing data protection standards across Southeast Asia. While it doesn’t establish a binding law like the European Union’s General Data Protection Regulation (GDPR)<\/a><\/b>, it serves as a guiding framework to encourage member states to develop and strengthen their data protection laws and practices. This cooperative agreement facilitates digital trade and information flow, respecting the framework’s principles. It emphasizes personal data protection, cooperation among members, free information flow, and maintains confidentiality. Amendments require mutual agreement.<\/p>\n The framework, established in 2016,<\/b> provides broad principles for data governance, complemented by the 2018 ASEAN Framework on Digital Data Governance and has also a major role to play in reinforcing defenses against cyber-attacks, including Ransomware, through strict data management practices.<\/p>\n<\/div><\/div><\/div><\/div><\/div> Let\u2019s focus on the data protection laws<\/b> of certain countries (Singapore, Malaysia, the Philippines, Thailand, Vietnam and Indonesia) in the ASEAN<\/b>. Differences can be observed between some countries leading the way by taking inspiration from the GDPR in 2018, and others being a little further behind regarding this matter.<\/p>\n<\/div><\/div><\/div> Major amendments effective from February 2021 include increased financial penalties and provisions against dictionary attacks and address harvesting software. Penalties for non-compliance include a maximum financial penalty of 10% of an organization’s annual turnover in Singapore if it exceeds S$10 million<\/b>, applicable after October 1, 2022, or S$1 million otherwise.<\/b><\/div><\/div><\/div> In January 2023, Communications and Digital Minister of Malaysia Fahmi Fadzil mentioned that the Personal Data Protection Department (\u201cJDPD\u201d)<\/b> is refining the amendments with additional aspects for improved applicability. A key change includes mandatory breach notifications by companies to JPDP. Fahmi highlighted the need for increased fines for data misuse, noting the inadequacy of current penalties with an average fine of RM24,000 per company since 2017<\/b>.<\/div><\/div><\/div> The Philippines’ National Privacy Commission issued Circular No. 2022-01, effective August 27, 2022, introducing fines for Data Privacy Act breaches. Fines vary based on the severity of infraction, with a maximum cap of PHP 5 million for grave violations<\/b>. The circular ensures due process before imposing fines, and non-payment may result in legal consequences.<\/div><\/div><\/div> In Indonesia, the Personal Data Protection Law imposes criminal sanctions for unauthorized data activities with penalties of up to 6 years imprisonment and fines up to IDR 6 billion.<\/b> Corporations may face tenfold higher fines and additional consequences like dissolution. Administrative sanctions include warnings, suspensions, and fines.<\/div><\/div><\/div> In Thailand, non-compliance with the Personal Data Protection Act 2019 (PDPA) can result in civil actions for damages, criminal penalties including fines and imprisonment<\/b> for abusive use of data, and administrative fines of up to five million baht for violations <\/b>such as unauthorized data processing or failure to notify data breaches.<\/div><\/div><\/div> In Vietnam, non-compliance with the Data Privacy Law can lead to varying penalties. Failing to obtain consent for data collection may result in fines up to $850<\/b>, while improper use of data can incur fines around $2,560<\/b>. Additionally, violations of data safety and confidentiality rules can attract criminal sanctions, including warnings, fines, and prison sentences up to 3 years.<\/span><\/div>Differences between APAC countries<\/h2><\/div><\/div><\/div>
<\/i><\/i><\/span>Singapore<\/span><\/a><\/h4><\/div>
<\/i><\/i><\/span>Malaysia<\/span><\/a><\/h4><\/div>
<\/i><\/i><\/span>Philippines<\/span><\/a><\/h4><\/div>
<\/i><\/i><\/span>Indonesia<\/span><\/a><\/h4><\/div>
\nIndonesia’s new Personal Data Protection Law (PDP Law), Law No. 27 Year 2022,<\/b> was enacted on 17 October 2022, marking significant progress in personal data protection. This global law offers more comprehensive and integrated protection than previous, fragmented regulations. It applies to individuals, corporations, public entities, and international organizations within Indonesia, and affects foreign entities if legal impacts occur in Indonesia or involve Indonesian citizens.<\/p>\n<\/i><\/i><\/span>Thailand<\/span><\/a><\/h4><\/div>
\nThailand’s Personal Data Protection Act 2019 (PDPA)<\/b> has been delayed until May 31, 2022, due to COVID-19. The PDPA establishes the Personal Data Protection Committee (PDPC)<\/b> for regulatory guidance and includes key data subject rights, such as access, rectification, protection of personal data, etc. Organizations must appoint a Data Protection Officer (DPO)<\/b>, implement data subject request processes, monitor data risks, optimize data collection, document breaches, control third-party access to data, approve a data protection plan and keep up-to-date with regulatory changes.<\/p>\n<\/i><\/i><\/span>Vietnam<\/span><\/a><\/h4><\/div>
\n<\/b><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div><\/div>Anonymize your data with DOT Anonymizer!<\/h2><\/div><\/div><\/div>
<\/span><\/div>How to eliminate the risk of data leaks, and why an in-house solution is not always the best solution?<\/h2><\/div><\/div><\/div>