International – ASEAN proposes Model Clauses for international data transfers
Browse this blog post
Related news and insights
Blog Post: 26 April 2022
New Global Cross-Border Privacy Rules Forum established by APEC CBPR members
On 22 January 2021, the Digital Senior Officials’ meeting of the Association of Southeast Asian Nations (ASEAN) approved model contractual clauses for cross-border data flows (ASEAN Model Clauses) and related guidance on their implementation. The ASEAN Model Clauses include two sets of contractual terms to cover controller-processor and controller-to-controller situations.
The ASEAN Model Clauses are primarily designed for transfer of data between entities located in ten ASEAN member states (including Indonesia, Singapore, Cambodia, Philippines, Thailand and Vietnam), but may also be adapted for use for data transfers within the same country, or to other countries with similar data protection principles. The use of the ASEAN Model Clauses is voluntary.
The ASEAN Digital Senior Officials’ Meeting has also approved a data management framework (the DMF) aimed to assist businesses in the region to comply with transparency and accountability obligations. The DMF provides non-binding guidance for private commercial organisations on best practices in the area of data governance, addressing both personal data and any other data generated by business.
National regulators of Indonesia and Singapore have addressed the availability of the ASEAN Model Clauses and the DMF for businesses in their jurisdictions.
The data protection authority for Singapore (the PDPC) encourages organisations to use the DMF and the ASEAN Model Clauses to meet the requirements for international transfer under Singapore data protection law (the PDPA). The PDPC has issued additional guidance on use of the ASEAN Model Clauses, including recommended clarifications and amendments for use in compliance with the PDPA.
The ASEAN Model Clauses are available here, the DMF is available here and the press release of the ASEAN Digital Ministers’ Meeting here. The Singaporean PDPC press release is available here and the guidance is available here. The press release by Indonesia’s Ministry of Communications and Information Technology (Kominfo) is available here (only in Indonesian).