BCs Comparative Table of Data Privacy Laws in ASEAN

Name of Primary
Legislation
Name of Enforcement
Agency
Jurisdiction
Name and Type of Parties

Malaysia
Personal Data Protection Act 2010

Philippines
Data Privacy Act 2012

Personal Data Protection

Department

National Privacy Commission

Data User
persons established in Malaysia and
persons who are not established in
Malaysia but who use equipment in
Malaysia for processing personal
information.

Personal Information
Controller
a person or organization who
controls the collection, holding,
processing or use of personal
information, including a person
or organization who instructs
another person or organization to
collect, hold, process, use,
transfer or disclose personal
information on his or her behalf.
The term excludes:

Data Subject Person whose

personal information is subject to
Act
Personal Information Processor any natural or juridical person
qualified to act as such under this
Act to whom a personal information
controller may outsource the
processing of personal data
pertaining to a data subject.

(1) A person or organization who

performs such functions as
instructed by another person or
organization; and
(2) An individual who collects,
holds, processes or uses
personal information in
connection with the individuals
personal, family or household
affairs.

Data Subject

Singapore
Personal Data Protection Act
2012
Personal Data Protection
Commission

Definition of Information /
Data

Separate category of
Information / Data
Definition of Processing
and Transfers
Registration Requirement
Do-Not-Call Regime
Breach Notification
Data Protection Officer
Requirement
Main Principles
Criminal Liability
Civil Liability

Personal Data

Personal Information

Personal Information

N.A.

Yes; all data users must register with

the PDPD
N.A.

Privileged Information Sensitive

Personal Information
Excludes transfers; transfer is
not defined
No System of Mandatory
Registration
N.A.

No

Yes

Yes

Does not apply to personal data

processed outside of Malaysia,
unless that data will be further
processed in Malaysia.
Sensitive Personal Data
Includes transfers

No System of Mandatory
Registration
Yes

Yes, individuals have the right to

bring a civil claim against a noncompliant data organisation.