SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
Due Diligence Stage Where X is only a prospective party to the transac - tion, it may collect personal data, and Y may disclose such data, only to the extent necessary to determine whether to proceed with the transaction. In addition, the parties must have entered into an agreement requiring X to use or disclose the personal data solely for purposes connected with the transaction. Post-Completion Use and Notification If the transaction proceeds, X may use or disclose the personal data collected only for the same pur - poses for which Y would have been permitted to do so. Any personal data that does not relate directly to the business or assets acquired must be returned or destroyed. The parties must also notify the affected individuals that the transaction has taken place and that their personal data has been disclosed to X. Incomplete Transactions If the transaction does not proceed or is not com - pleted, all personal data collected in connection with the transaction must be returned to Y or securely destroyed. Change-of-Control and Indirect Transactions Similar rules apply where the transaction involves the transfer of an interest in a third organisation, such as a share sale. In Singapore, the PDPA regulates cross-border per - sonal data transfers. Non-personal data is generally not subject to transfer restrictions unless sector-spe - cific or cybersecurity laws apply. While a “transfer” is not expressly defined in the PDPA, it would broadly cover any disclosure, sending or making available of personal data to a recipient outside Singapore, wheth - er directly or through remote access. Pursuant to Section 26 of the PDPA, organisations may only transfer personal data overseas if they have taken reasonable steps to ensure that the recipient is subject to binding obligations that afford a level of 5. International Considerations 5.1 Restrictions on International Data Transfers
protection comparable to the PDPA. Under the PDP Regulations, such obligations may arise from: • any law; • any contract requiring the overseas recipient to afford the transferred personal data a level of protection comparable to that under the PDPA, and which identifies the countries and territories to which the personal data may be transferred under the contract; • any binding corporate rules (in cases where a recipient is an organisation related to the transfer - ring organisation) that require every recipient to provide to the transferred personal data a standard of protection that is at least comparable to the pro - tection under the PDPA, and which specify: (a) the recipients of the transferred personal data to which the binding corporate rules apply; (b) the countries and territories to which the per - sonal data may be transferred under the bind- ing corporate rules; and (c) the rights and obligations provided by the binding corporate rules; or • any other legally binding instrument. In relation to binding corporate rules, the PDP Regula - tions define a recipient as being related to the transfer - ring organisation if: • the recipient, directly or indirectly, controls the transferring organisation; • the recipient is, directly or indirectly, controlled by the transferring organisation; or • the recipient and the transferring organisation are, directly or indirectly, under the control of a com - mon person. The PDP Regulations expressly recognise certification under the APEC Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) frame - works as an accepted basis for international data transfers. Where an overseas recipient holds a rel - evant CBPR or PRP certification that is recognised in its jurisdiction, it is deemed to be subject to enforce - able obligations ensuring that the transferred personal data is protected to a standard comparable to that required under the PDPA.
424 CHAMBERS.COM
Powered by FlippingBook