SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
3.2 Interaction of Data Regulation and Data Protection See 1.1 Overview of Data and Privacy-Related Laws . 3.3 Rights and Obligations Under Applicable Data Regulation In Singapore, there is no legislation specifically regu - lating the use of IoT or other non-personal data servic - es beyond existing frameworks for personal data. Key obligations under the PDPA, set out in 3.1 Objectives and Scope of Data Regulation , continue to apply where personal data is involved, and organisations must implement measures to ensure compliance. The PDPC issued a Guide to Data Sharing (revised 1 February 2018), which provides guidance on the shar - ing of personal data: • within the organisation or group of organisations;
• appointing a responsible officer (ie, DPO); • monitoring data flows; and • ensuring contractual compliance with data inter - mediaries. 3.4 Regulators and Enforcement See 1.7 Regulators .
4. Sectoral Topics 4.1 Use of Cookies
In Singapore, there are no standalone statutory rules that specifically regulate cookies, SDKs or similar tracking technologies. Instead, the PDPA applies where these tools are used to collect, use or disclose personal data. The PDPC has clarified that tracking technologies which process personal data are subject to the same requirements as other forms of personal data processing, while cookies that do not identify individuals generally fall outside the PDPA’s scope. A consent-based framework applies according to the Advisory Guidelines for Selected Topics (revised 23 May 2024). For online functions that a user has expressly requested, organisations may not need to obtain separate consent for the use of cookies where the user understands the purpose and voluntarily pro - vides their data. Where a service cannot operate with - out cookies that process personal data, consent may be deemed if it is reasonable to expect the individual to provide such data for that activity. This includes activities such as: • authentication and security; • user preference; • network management; and • streaming content. However, a user’s failure to adjust browser or device settings does not, by itself, amount to consent. In contrast, tracking for purposes such as personalised advertising or profiling generally requires clear and express consent, rather than reliance on implied con - sent or opt-out models.
• with a data intermediary; and • with one or many organisations.
Specifically, compliance with the following are key issues that would arise in the context of data sharing: • consent obligation;
• purpose limitation obligation; • notification obligation; and • transfer limitation obligation.
The IMDA’s Internet of Things Cyber Security Guide (published March 2020) for IoT services provides practical obligations for developers, providers and enterprise users, focusing on security principles, risk management and operational best practices, though it explicitly excludes privacy matters. Organisations deploying IoT or cloud-based systems should inte - grate these baseline security measures with PDPA obligations. Data intermediaries are also bound by the PDPA and must ensure that they comply with the applicable PDPA obligations set out at 3.1 Objectives and Scope of Data Regulation . Action items for organisations therefore include, but are not limited to:
422 CHAMBERS.COM
Powered by FlippingBook