Certified Information Privacy Professional/Asia Free Sample Questions

India's Digital Personal Data Protection Act, 2023 (DPDPA) provides a specific exemption for the processing of personal data that is made publicly available by the Data Principal themselves or by any other person under a legal obligation. Singapore's PDPA exemption for publicly available data is narrower and generally applies to data in public registers like directories. Hong Kong's PDPO does not have a general exemption for publicly available data, meaning its processing is still subject to the Data Protection Principles.

Under Singapore's PDPA, a data intermediary processing personal data on behalf of another organization is only subject to the Protection Obligation and the Retention Limitation Obligation. The primary responsibility for other obligations, including data breach notification, remains with the data controller (the e-commerce client). The data intermediary's contractual duty is to notify its client without undue delay, enabling the client to fulfill its notification obligations to the PDPC and affected individuals.

The PDPO's direct marketing provisions require that when using personal data for direct marketing for the first time, the data user must inform the individual of their right to opt-out, provide a response channel to exercise this right, and state the intention to use their data for direct marketing. The contact info of the PCPD and the specific marketing manager are not required elements.

The DPDPA requires 'verifiable' parental consent for processing children's data. This implies a higher standard than a simple checkbox or passive consent. Using a robust authentication method like a national ID-linked parent portal provides a strong, auditable trail that reasonably ensures the person giving consent is indeed the parent or legal guardian. This is a much stronger method than the others, which are easily circumvented by the child.

This is the most comprehensive strategy. Relying solely on employment contract consent is weak, especially in the employer-employee context. While APEC CBPR is a valid mechanism for Singapore, its recognition in Hong Kong and India is less established as a standalone solution. The most robust approach involves using contractual safeguards (intra-group agreements, often based on model clauses) to ensure the recipient is bound to protect the data, supplemented by specific, explicit consent for the transfer itself. This layered approach addresses the requirements across all three jurisdictions for ensuring the recipient provides a comparable level of protection.

As of early 2025, Section 33 of the PDPO has not yet come into effect. While it is part of the ordinance, its implementation has been deferred. Therefore, organizations in Hong Kong currently rely on other measures like contractual clauses and consent to ensure protection for cross-border data transfers, rather than the specific mechanisms outlined in Section 33.

The APEC CBPR system is a voluntary, accountability-based system. Its goal is not to create a single law but to build trust in cross-border data flows by allowing companies to be certified by an 'Accountability Agent' as compliant with the APEC Privacy Framework. This certification helps bridge differences between national privacy laws and facilitates data transfers between participating APEC economies.

Under Singapore's PDPA, data breach notification to the PDPC is mandatory if (1) the breach is likely to result in significant harm to an individual, OR (2) the breach affects 500 or more individuals. The source of the breach (vendor error) or the type of data (health information) are factors in assessing harm, but the notification triggers are the 'significant harm' threshold and the 'scale' threshold (500 individuals).

DPP2 explicitly states that personal data should not be kept for longer than is necessary to fulfill the purpose for which it was collected. Keeping recordings indefinitely without a clear, time-bound justification directly contravenes the duration of retention aspect of this principle. While other DPPs might be relevant, the core violation here is the lack of a retention policy.

The DPDPA imposes additional compliance burdens on organizations designated as Significant Data Fiduciaries. Key among these are the mandatory appointment of a Data Protection Officer (DPO) who must be based in India, and the requirement to undertake periodic Data Protection Impact Assessments (DPIAs) to evaluate and mitigate risks associated with their data processing activities.