Singapore and Malaysia are setting the pace for data-protection rigor in the Southeast Asia region, and other countries are quickly catching up.
For businesses like yours, navigating these regulations can be a maze at best, a potentially financial nightmare at worst. That’s why Crown Records Management have put together this straightforward guide. If you’re doing business in Singapore, Malaysia, or Southeast Asia as a whole, it’s vital to understand the changing regulatory environment and what this entails for how you use, store and dispose of data efficiently and most importantly, legally.
With our regional expertise in information management across the ASEAN (Association of Southeast Asian Nations) region, we aim to simplify the complexities and ensure you’re always guided in the right direction, protecting data, and building lasting trust with your customers.
THE PIONEERS:
MALAYSIA AND SINGAPORE
MALAYSIA
For business operating in Malaysia, understanding the Personal Data Protection Act 2010 (PDPA) is crucial.
Serving as the country’s foundational data protection law, the PDPA lays out clear guidelines for the management of personal data in commercial settings. It ensures that businesses uphold the sanctity of personal data, emphasising transparency, accuracy, and security.
Given the dynamic nature of the digital world, Malaysia is continuously refining its stance on data protection. A case in point is its recent move towards introducing mandatory data breach notifications, aiming to ensure that businesses are not only compliant but also equipped to handle and report potential breaches promptly.
WHAT’S NEW?
Malaysia’s Progressive Strides: Malaysia’s proposal for a 72-hour mandatory data breach notification system showcases its intent to bolster its data protection regime. These moves, aligning with global best practices – like notification systems in Europe, underscore Malaysia’s focus on international alignment.
SINGAPORE
Singapore’s Personal Data Protection Act 2012 (PDPA) offers a comprehensive framework that businesses need to familarise themselves with.
Recognising the increasing importance of data in business strategies and operations, the PDPA is designed to strike a balance between business needs and individual data rights. It mandates businesses to be transparent in their data practices, ensuring that individuals are informed and have control over their personal data.
For businesses, this means not just adherence to rules but also an opportunity to build trust with customers and stakeholders. The proactive stance of Singapore’s PDPA, including its focus on individual empowerment, serves as a benchmark for the region, emphasising the city-state’s widely recognised commitment to creating a business-friendly yet secure data environment.
A history of innovation:
Singapore’s PDPA was among the first national-level data protection laws that mandated organisations must notify an individual about how his or her data will be. 1990s-era data-protection legislation, such as the EU’s 1995 Data Protection Directive, did not mandate this.
WHAT’S NEW?
Singapore’s Landmark Ruling: The case between Reed and Bellingham in 2022 was pivotal for Singapore’s data protection sphere. This case broadened the “loss or damage” scope under the PDPA to include emotional distress, showcasing the evolving nature of data protection rights.
More severe fines: From October 2022, organisations in Singapore now face fines up to 10% of their annual turnover for data breaches under the PDPA, if their turnover exceed SGD 10 million. This change stems from the 2020 amendments to the Personal Data Protection Act. This changes previous penalties whereby the maximum fine was a fixed sum of up to SGD 1 million, bringing it more in line with GDPR-like legislation.
Did You Know? While the PDPA in Singapore and GDPR in Europe both emphasise individual data rights and protections, the PDPA offers a more streamlined approach, making it, theoretically at least, easier for businesses to understand and implement.
DID YOU KNOW?
While ASEAN has no supranational authority to issue legal directives (as with the EU and GDPR), member states did agree to a “Data Protection Framework” in 2016, which has led to increasing harmonisation on data protection framework.
DATA PROTECTION IN THE WIDER REGION
Thailand
Since the Personal Data Protection Act (PDPA) came into effect in June 2021, Thailand has been active in refining its data protection stance. Guidelines like the Consent Guideline released in September 2022 and the Notification Guideline elucidate the requirements for businesses, ensuring clarity in compliance efforts.
Vietnam
While Vietnam doesn’t boast a singular privacy law, updates to the Vietnamese Civil Code in 2015 have ensured comprehensive protection of personal data and confidentiality. The legislation emphasises preventing unauthorised personal information sharing, covering both personal data and personal correspondence.
Indonesia
The introduction of the Personal Data Protection Law (PDPL) in October 2022 marked a turning point for Indonesia. Drawing parallels with the EU’s GDPR, it mandates explicit consent and prescribes penalties for data breaches, underlining Indonesia’s dedication to data protection.
Philippines
The Data Privacy Act 2012 is foundational to the Philippines’ commitment to personal information protection. It mandates explicit consent and the creation of proper data processing systems. The recent NPC Circular No. 2022-01 further refines this, categorising infractions based on various criteria.
DEVELOPMENT ACROSS SOUTHEAST ASIA
Comprehending the region’s data protection ecosystem is crucial for anyone based here or looking to do business here. While Malaysia and Singapore have robust mechanisms in place, nations like the Philippines, Vietnam, Indonesia, and Thailand are not far behind, as the developments of the past two years show.
Most importantly for business, the fines are only becoming more severe, as the above example of Singapore shows (this is true for the Philippines’ enforcement mechanism as well, as a note). Teeth are not lacking either, the average cost of a data breach in the ASEAN (Association of Southeast Asian Nations) is SGD 3.6 million, according to IBM (and this was prior to the tightening of financial penalties in 2022).
Each nation, with its distinct regulatory setup, offers varies challenges and opportunities. but the emphasis on individual rights, explicit consent, and business transparency is a unifying theme across the board, as we explored in our piece exploring China’s PIPL.
Need help in charting a course through this tricky compliance landscape? Crown Records Management is here to help. With local expertise across the ground throughout all countries listed, we can help store and manage your data as well as give you guidance on how your data operates holistically, to ensure you’re always well within the law.
