SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
Drew & Napier LLC 10 Collyer Quay 10th Floor Ocean Financial Centre
Singapore 049315 Tel: +65 6531 4110 Fax: +65 6535 4864
Email: mail@drewnapier.com Web: www.drewnapier.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Singapore’s data protection framework is laid out in the Personal Data Protection Act 2012 (PDPA), which is the main statute governing the collection, use, disclosure and care of personal data in the private sector. Oversight, administration and enforcement of the PDPA are vested in the Personal Data Protection Commission (PDPC). The core data protection obligations are set out in Parts 3 to 6A of the PDPA. These provisions regu - late, among other matters, the collection, use, disclo - sure, access, correction, accuracy security, retention, overseas transfer of personal data and notification of data breaches (collectively, the “Data Protection Provisions”). In addition, Parts 9 and 9A of the PDPA establish Singapore’s national Do Not Call (DNC) Reg - istry, and set out the duties imposed on organisations in relation to the transmission of specified marketing communications to Singapore telephone numbers. The PDPA was updated through the Personal Data Protection (Amendment) Act 2020. The majority of the significant amendments, including mandatory data breach notifications and new consent-related provi - sions, took effect on 1 February 2021. The PDPA has both territorial and extraterritorial effect, applying to all organisations that are not a pub - lic agency, whether or not formed or recognised under
the laws of Singapore, or resident or having an office or a place of business in Singapore. The PDPA is supplemented by subsidiary regulations, including the following: • Personal Data Protection Regulations 2021 (the “PDP Regulations”), which address matters such as data transfers out of Singapore and procedures relating to access and correction requests; • Personal Data Protection (Enforcement) Regula - tions 2021 (the “Enforcement Regulations”), which govern enforcement processes and powers; • Personal Data Protection (Notification of Data Breaches) Regulations 2021, which prescribe thresholds and timelines for mandatory breach notification; • Personal Data Protection (Composition of Offenc - es) Regulations 2021; • Personal Data Protection (Appeal) Regulations 2021; and • Personal Data Protection (Do Not Call Registry) Regulations 2013. These regulations are legally binding and are issued pursuant to the PDPA. The PDPA operates alongside sectoral laws and regu - lations that set out further data protection and cyber - security obligations for the compliance of regulated entities. Some examples include:
411 CHAMBERS.COM
Powered by FlippingBook