# Standards and Regulatory References

## Regional Frameworks

### APEC Privacy Framework (2015 Update)
- Adopted by APEC Ministers in 2004; updated in 2015.
- Nine privacy principles forming the basis of the CBPR system.
- Endorsed by 21 APEC member economies.

### APEC Cross-Border Privacy Rules (CBPR) System
- Established under the APEC Privacy Framework.
- Accountability Agents: TRUSTe (US), JIPDEC (Japan), IMDA (Singapore), KCC (South Korea).
- Global CBPR Forum (April 2022) aims to expand participation beyond APEC.

### ASEAN Framework on Personal Data Protection (2016)
- Adopted at the 16th ASEAN Telecommunications and IT Ministers Meeting.
- Non-binding principles for ASEAN Member States.
- Basis for the ASEAN Model Contractual Clauses.

### ASEAN Model Contractual Clauses (2021)
- Adopted by ASEAN TELMIN in 2021.
- Controller-to-controller and controller-to-processor templates.
- Non-binding; Member States may adapt.

## Country-Specific Legislation

### Japan — APPI
- **Act on the Protection of Personal Information** (Act No. 57 of 2003, as amended 2022)
- **Art. 28**: Cross-border transfer requirements (consent, adequate country, equivalent measures)
- **PPC Rules for Cross-Border Transfer** (Art. 17): Information provision requirements before consent
- **PPC Supplementary Rules**: Additional obligations for EU-origin data under the mutual adequacy arrangement

### South Korea — PIPA
- **Personal Information Protection Act** (Act No. 14839, as amended 2023)
- **Art. 28-2**: Cross-border transfer provisions (consent, adequacy, contractual safeguards, certification)
- **PIPC Notification No. 2023-1**: Adequacy recognition criteria and process

### Thailand — PDPA
- **Personal Data Protection Act B.E. 2562** (2019, effective 1 June 2022)
- **Section 28**: Cross-border transfer requirements
- **PDPC Notification**: Adequacy standards (pending publication)
- **PDPC Notification on Data Processing Agreement**: Requirements for processor contracts

### Singapore — PDPA
- **Personal Data Protection Act 2012** (No. 26 of 2012, as amended 2021)
- **Section 26**: Transfer limitation obligation
- **PDPC Advisory Guidelines on Key Concepts in the PDPA (2022 revision)**: Guidance on Section 26 compliance
- **Data Protection Provisions (2021 amendments)**: Increased penalties

### Hong Kong — PDPO
- **Personal Data (Privacy) Ordinance** (Cap. 486)
- **Section 33**: Restriction on transfer of personal data outside Hong Kong (not yet commenced)
- In practice, Section 33 is not in force; transfers governed by contractual arrangements

## Enforcement Precedents

### Japan PPC — Warning to Online Service Provider (2023)
- PPC issued a warning for cross-border transfer without providing required foreign country information to data subjects before obtaining consent.

### Singapore PDPC — Financial Penalty on Ride-Hailing Company (2022)
- SGD 750,000 fine for transfer of personal data to third countries without ensuring legally enforceable obligations on recipients.

### South Korea PIPC — Administrative Measure on E-commerce Platform (2023)
- PIPC ordered an e-commerce platform to revise its cross-border transfer practices after finding inadequate consent mechanisms for transfers to non-adequate countries.

### Thailand PDPC — Guidance Notice on Cross-Border Transfers (2023)
- PDPC issued guidance clarifying that pending the adequacy list, organisations should rely on contractual safeguards or explicit consent for all cross-border transfers.