CIPP/A Author prep: Asia privacy laws

Learn how fair information practices (FIPs) originated in privacy debates and were shaped by the OECD, emphasizing transparency, purpose, specification, data minimization, and rights to access and correct personal data.

Explore the OECD privacy principles from 1980, detailing eight fair information practices—collection limitation, data quality, purpose specification, use limitation, security safeguards, openness, individual participation, and accountability—that shape global privacy laws.

Explore how Asia-Pacific economies align privacy protection with free data flow under the APEC framework, balancing harm prevention, notice, collection limits, and accountability to support global business and interoperable enforcement.

Explore how the Universal Declaration of Human Rights enshrines privacy, highlights Article 12’s protection, and shows its influence on Hong Kong, Singapore, and India’s privacy laws.

Explore how the General Data Protection Regulation standardizes cross-border data protection, strengthens consent, data subject rights, and data protection by design, and imposes accountability on controllers and processors.

Understand how adequate and non adequate jurisdictions govern GDPR data transfers outside the EU and apply safeguards like standard contractual clauses or explicit consent.

Explain how EU-US data transfers evolved from Safe Harbor and Privacy Shield to the 2023 EU-US Data Privacy Framework adequacy decision, enabling transfers via SCCs or BCRs.

Explore what GDPR classifies as sensitive data, including genetic, biometric, and health information, plus race, political opinions, religion, and union membership, with its processing rules and exceptions.

Define personal data under the GDPR and compare with US and Canada rules, then explain four elements—information, relation to a natural person, content, and purpose or result.

Define personally identifiable information in the United States, distinguish direct and indirect identifiers, and summarize sectoral privacy laws (HIPAA, COPPA, FCRA, CCPA) and regulatory fragmentation.

Hong Kong defines personal data broadly as any data relating to living individuals that can identify them, while Singapore defines it as data about an identifiable person and related information.

Define sensitive personal data under Indian law, including passwords, bank account and credit or debit card details, health, sexual orientation, medical records, biometric data, and related processing by body corporate.

Explore the legislative history and origins of Singapore's legal system, from Raffles and the Second Charter of Justice to the Straits Settlements and independence in 1965.

Examine Singapore's English common law roots and its balance of common law, equity, and statutes. Highlight the doctrine of precedent and the Constitution as supreme, guiding binding judgments.

Examine breach of confidence in Singapore: confidential information disclosed or obtained without authorization, with quality of confidence and obligation of confidence, including non-disclosure agreements and equitable duties.

Trace the development and amendments of Singapore's PDPA 2012 and the PdPC's enforcement, and examine challenges from artificial intelligence, cross-border data flows, and future directions.

Define personal data under the act and explain its scope, including organizations' obligations regarding data processed by processors and GDPR's reach to deceased individuals within ten years, with key exclusions.

Understand Singapore's Do Not Call registry under the Personal Data Protection Act and its impact on consumers and businesses. Learn registration, compliance, and penalties under the Personal Data Protection Commission.

Explore how Singapore's Personal Data Protection Act is enforced by the Personal Data Protection Commission, including investigations, orders to stop breaches, penalties, and advisory education to ensure cross-border data flow.

Explore data breach obligations under Singapore privacy law and GDPR, including notifiable breaches, notification timelines, penalties, and best practices for prevention, response, and private action.

Illustrates how the monetary authority of Singapore acts as the central bank and financial regulator, overseeing monetary policy, currency management, AML/CTF, KYC, and banking supervision, with guidelines and cybersecurity duties.

Explore advisory guidelines on the PDPA for children's personal data in the digital environment, including consent, age verification, data minimization, and age assurance.

Analyze Hong Kong's PDPO from its 1995 enactment to 2021 amendments addressing doxing and direct marketing, and the privacy commissioner's enhanced enforcement powers.

Apply the Hong Kong personal data privacy ordinance to any data user that collects or processes personal data within Hong Kong. It covers living individuals and direct and indirect identifiers.

Explore Hong Kong's data protection principles under the ordinance, including collection purpose and manner, accuracy and retention, use restrictions, direct marketing consent, security, openness, access and correction, and applicable exceptions.

Identify legal bases for processing personal data under Asia privacy laws, notice or consent, and recognize exemptions for crime prevention, contrasting these rules with Europe.

Explore employee monitoring in Hong Kong under personal data ordinance, applying assessment, alternatives, and accountability. Assess examples like email usage, web browsing, and call records.

Defines direct marketing under Hong Kong’s ordinance and explains personal data use for marketing with guidance from the privacy commissioner, including when exceptions apply and what counts.

Explore consent rules for direct marketing under part six, including explicit consent, no objection, withdrawal, and that silence does not equal consent; with practical notices and information to data subjects.

Explore how Hong Kong and the GBA regulate data flows under the 2023 MoU, GBA standard clauses, and related cross-boundary transfers, due diligence, and eight-part implementation guidelines.

Understand data breach causes, including cyber attacks, misconfigurations, and loss of physical or digital personal data. Learn to implement a data breach response plan to minimize impact and protect individuals.

Explore the data breach response lifecycle under GDPR, covering preparation, detection, analysis, containment, recovery, and post-incident review, with roles, notification timelines, and breach registers.

learn how to issue a data breach notification to data subjects, the commissioner, and regulators, detailing breach scope, risks, and mitigation steps to protect privacy and safety.

The office of privacy commissioner for personal data is the dedicated data privacy regulator; it processes complaints, conducts investigations, and may issue enforcement notices with penalties including fines and imprisonment.

Describe Hong Kong SAR data protection rules for data subject access requests, including identity verification, providing a copy of personal data within 40 days, and non-excessive fees.

Examine India's data privacy framework, including IT act amendments, sections 43A and 72A, 2011 SPDI rules, the article 21 right, and implications for foreign investment.

Discover how India's constitution protects privacy via article 21 and related provisions, with the Supreme Court recognizing a right to privacy in Puttaswamy v Union of India and data protection.

Explain how the 1993 act establishes the national and state human rights commissions and courts to protect rights, including privacy.

Explore how India's Right to Information Act 2005 promotes transparency by disclosing public records while balancing privacy through section eight exemptions, public interest overrides, and oversight by public authorities.

Explore the Information Technology Act 2000, its recognition of electronic transactions and digital signatures, data protection provisions, cybercrime offences, and regulatory framework for electronic governance and certifying authorities in India.

Navigate the information technology rules of 2011 for sensitive personal data, clarifying applicability to the body corporate in India and outlining consent, privacy policy, and ISO 27001 safe harbor.

Explore India's sensitive personal data rules on passwords, financial data, biometric information, medical records, and health details, plus consent, transfer, privacy policy, and section 43A and ISO 27001 compliance.

Explore penalties under India's IT act 2000 for unauthorized data access and breach of confidentiality under sections 43, 43b, 43g, 72, and 72a, plus a 2019 case on section 70(2)a.

The information technology rules of 2011 require appointing a grievance officer to address data subject grievances within one month, publish contact details, and coordinate with authorities for timely redressal.

India enforces data protection through regulators like the Ministry of Communications and Information Technology and the Telecom Regulatory Authority of India, plus the National Do Not Call Registry and RBI.

India's new cybersecurity and incident reporting regime, led by CERT, mandates six-hour reporting, clock synchronization, and retention of customer data, logs in India, and KYC records.

This lecture outlines the India data protection act update for the CPA exam, covering scope, exemptions, key terms (data subject, controller, processor), principles, lawful bases, enforcement, and breach rules.

Trace India's journey from privacy as a fundamental right to the 2023 digital personal data protection act, detailing milestones from the 2017 ruling to the 2023 act and new rights.

Clarify the DP dpa act's scope for digital personal data in India. Highlight extraterritorial processing and exemptions for personal use and data made public by the data principal.

Explore the three key actors under the DPA—data fiduciary, data principal, and data processor—clarifying roles, rights, and obligations, including significant fiduciaries and the data protection officer requirement.

Identify what counts as personal data, understand processing and breaches under the digital personal data protection act, and note how sensitive data is treated compared with GDPR.

Discover how the supervisory authority, the Data Protection Board of India, enforces the Digital Personal Data Protection Act by handling complaints, investigating breaches, and issuing binding directions with independent oversight.

Explain the two lawful bases for processing personal data—consent and specific legitimate uses—and how consent must be free, informed, and withdrawable, with examples like emergencies and legal obligations.

Data fiduciaries bear full responsibility for personal data under the law, even when contracting with processors, and must ensure accuracy, security, breach protection, data erasure, and grievance redressal mechanisms.

Explore data principal rights under the data protection act, including access, correction, erasure, grievance redressal, and nomination for your digital estate.

Explore how the Digital Personal Data Protection Act defines data breaches, mandates prompt notices to the Data Protection Board of India and data principals, and governs cross-border data transfers.

Explore how web technologies from packets and HTTP to HTTPS, HTML5, XML, and VPNs shape online privacy, including IP data, caching, and security considerations.

Examine privacy considerations for online information, identify threats from unauthorized access, social engineering, malware, phishing, and technical attacks, and review defense measures like two factor authentication and Transport Layer Security.

Explore mobile online privacy challenges, from compact privacy notices and geolocation data to third-party access, data collection and use, wearables with biometric health data, and evolving best practices.

Create online privacy notices that clearly describe what personal information is collected, how it is used and shared, with layered notices for transparency and accessibility under GDPR and regional laws.

Learn how electronic data collection and use drive online tracking and targeted advertising, while applying legal and ethical privacy responsibilities.

Analyze third party interactions and privacy considerations across syndicated content, web widgets, and advertising networks; address cross-site scripting risks and breach notifications, while ensuring contracts protect data and user trust.

Analyze how digital advertising dominates marketing budgets across desktop, mobile, and IoT. Explore privacy concerns from data gathering and tracking, including cross-device and cross-context tracking, consent, and regulations.