TRANSFERS UNDER PDPA Flashcards
What are the rules on data processing and export in Singapore?
Transfer is only allowed where the overseas organization provides a comparable standard of protection.
What does the PDPA mandate for transferring personal data outside Singapore?
The PDPA mandates that organizations ensure the recipient country provides a standard of protection comparable to that under the PDPA.
What mechanisms exist for transferring personal data under the PDPA?
Legally Binding Agreements: Agreements ensuring comparable protection standards. Binding Corporate Rules (BCRs): Multinational companies can adopt BCRs for intra-group data transfers - approved by the PDPC. Consent of Individuals: Explicit consent from individuals - with information on potential risks.
What is the Cross-Border Privacy Rules (CBPR) system?
A voluntary - enforceable privacy certification ensuring compliance with APEC’s data privacy standards for cross-border data transfers. Singapore is a participating economy in the CBPR system.
What is the Privacy Recognition for Processors (PRP) system?
Designed for data processors to demonstrate their ability to implement privacy protections consistent with the APEC Privacy Framework. Data processors can seek PRP certification to assure data controllers and stakeholders of their privacy protection capabilities.
What are the four steps of the CBPR System?
Self-assessment - Compliance review - Recognition/acceptance - Dispute resolution and enforcement
How does the CBPR System ensure compliance?
The CBPR System relies on an organization’s self-assessment of their data privacy policies and practices against the requirements of the 2015 APEC Privacy Framework using an APEC-recognized CBPR questionnaire provided by an APEC-recognized Accountability Agent.
