# APAC Cross-Border Transfer Workflow Reference

## Transfer Mechanism Selection Workflow (Per Jurisdiction)

### Japan (APPI Art. 28)

1. Check if destination country is on PPC adequate country list (currently EU/EEA and UK).
2. If adequate: transfer permitted without additional mechanism.
3. If not adequate: assess whether recipient has established "equivalent measures" (internal rules + oversight).
4. If equivalent measures in place: document the measures and proceed.
5. If no equivalent measures: obtain individual consent after providing required information about the destination country's protection level and the recipient's safeguards.

### South Korea (PIPA Art. 28-2)

1. Check if destination country is recognised by PIPC as having equivalent protection.
2. If recognised: transfer permitted.
3. If not recognised: options include:
   a. Obtain data subject consent with full information disclosure
   b. Execute contractual safeguards equivalent to PIPA standards
   c. Obtain PIPC-approved certification for the recipient
4. Document the mechanism relied upon.

### Thailand (PDPA Section 28)

1. Check PDPC adequate country list (pending publication; assume no adequate countries currently).
2. Establish contractual safeguards with PDPA-aligned clauses.
3. Alternative: obtain data subject explicit consent for the transfer.
4. For intra-group transfers: establish BCR-equivalent group policies.
5. Document the mechanism and maintain records.

### Singapore (PDPA Section 26)

1. Establish a contractual arrangement with the recipient binding them to PDPA-equivalent standards.
2. Alternative: rely on CBPR certification if the recipient is CBPR-certified.
3. Alternative: obtain individual consent after disclosure of non-comparable protection standards.
4. Document compliance with the transfer limitation obligation.

## Multi-Jurisdiction Transfer Chain Workflow

For a transfer chain such as EU → Japan → Singapore → Thailand:

1. **EU → Japan**: Verify EU adequacy decision for Japan (Decision 2019/419) covers the transfer. Confirm recipient implements PPC supplementary rules.
2. **Japan → Singapore**: Verify PPC adequate country status for Singapore (not currently listed). If not adequate: confirm recipient has "equivalent measures" per APPI Art. 28 or obtain consent.
3. **Singapore → Thailand**: Ensure Singapore PDPA Section 26 compliance (contractual arrangements with Thai recipient). Also ensure Thai PDPA Section 28 compliance (contractual safeguards).
4. **Document each leg**: Maintain transfer records for each jurisdictional leg of the chain.

## CBPR Certification Workflow

1. Determine if the organisation's APAC data flows would benefit from CBPR certification.
2. Select the Accountability Agent for the organisation's primary APAC jurisdiction.
3. Conduct a gap analysis against the APEC Privacy Principles.
4. Remediate gaps and implement required privacy practices.
5. Submit the CBPR self-assessment to the Accountability Agent.
6. Undergo Agent review and certification.
7. Maintain certification through annual compliance reviews.
8. Note: CBPR does not replace GDPR Art. 46 requirements for EU-origin data.

## ASEAN MCC Implementation Workflow

1. Identify ASEAN cross-border transfers requiring contractual safeguards.
2. Obtain the ASEAN MCC template from the ASEAN Secretariat.
3. Complete Schedule 1 (transfer description) and Schedule 2 (security measures).
4. Negotiate and execute the MCCs with the ASEAN data importer.
5. Integrate with any country-specific requirements (e.g., Thailand PDPA Section 28, Singapore PDPA Section 26).
6. File the executed MCCs in the transfer register.