About PDPA

All You Should Know About Protecting Data

 

 

Exemption Request of PDPA

Application for Exemption

(from the Transfer Limitation Obligation)

Transfer Limitation Obligation is one of the nine obligations of the main advisory guidelines. Under this obligation, a local company must not transfer any personal data to a country or territory outside Singapore unless done according to requirements prescribed under PDPA. 

However, organisation can apply for such transfer and PDPC may, notice in writing, exempt the orgnisation from any requirement under PDPA.

  • Section 26(1) of the PDPA provides that an organisation shall not transfer any personal data to a country or territory outside Singapore except in accordance with requirements prescribed under the PDPA to ensure that organisations provide a standard of protection to personal data so transferred that is comparable to the protection under the PDPA.
  • Section 26(2) of the PDPA provides that the PDPC may, on the application of any organisation, by notice in writing exempt the organisation from any requirement prescribed pursuant to section 26(1) in respect of any transfer of personal data by that organisation.
  • An exemption granted under section 26(2) may be granted subject to such conditions as the PDPC may specify in writing and may be revoked at any time by the PDPC.

Application for Exemption from any provision under the PDPA

    PDPC needs the approval of the Minister, to exempt an individual or organisation from all or any provision of PDPA.

    • Pursuant to section 62 of the PDPA, the PDPC may, with the approval of the Minister, by order published in the Gazette, exempt any person or organisation or any class of persons or organisations from all or any of the provisions of this Act, subject to such terms or conditions as may be specified in the order.

     

    Can my organisation apply for an exemption?

    Before applying for an exemption, the individual or organisation is encouraged to read all guidelines and use exemption as the last resort. When available resources cannot address the compliance issue, the organisation can submit an exemption request to PDPC at corporate@pdpc.gov.sg together with the following:

    1. Specify which provision of the PDPA are you seeking for exemption?
    2. The period you are seeking for exemption?
    3. Detailed explanation for seeking exemption and why you are not able to comply to that provision, with evidences supporting those reasons.
    4. List of alternatives you have considered other than seeking an exemption and why such alternatives are not feasible.
    5. If the exemption seek is pertaining transfer limitation obligation, you have to provide the ID of the individual/ organisation seeking exemption, together with the type and volume of personal data intended to be transferred. All relevant conditions of the transfer are also to be provided.
    6. For other exemptions other than transfer limitation obligation, you have to provide the ID of the individual/ organisation seeking exemption.
    7. Other relevant supporting information and documentation.

    Any exemption request is processed only when all information are provided. As tough as it looks, if deemed totally necessary, then request for an exemption. If not abide to the guidelines set by PDPA. 

    Persons or organisations that wish to apply for an exemption from any provision of the PDPA should first refer to PDPC’s Help for Organisations to consider if the issue can be addressed by any of the existing resources available on the PDPC’s website. Organisations that have queries concerning the interpretation and application of the PDPA should refer to the advisory guidelines and FAQs, or contact us through our Feedback Form. If the available resources do not address the compliance issue, organisations may submit an exemption request following the instructions below:

    Application for an exemption should be submitted to the PDPC at corporate@pdpc.gov.sg with the following:

    1. The provision(s) of the PDPA for which the exemption is sought
    2. The period(s) for which the exemption is sought
    3. Detailed explanation of the reasons for seeking the exemption from the PDPA provision(s), why non-compliance is necessary, and evidence supporting those reasons
    4. Whether there are any alternative courses of action (i.e. apart from obtaining an exemption) that have been considered that would not lead to a breach of the provision(s), with explanations on why such alternatives are not feasible
      • For example, in the case of a section 26(2) application, detailed explanation of the reasons why the organisation is unable to rely on the avenues provided for in Part III of the Personal Data Protection Regulations 2014 to comply with section 26 of the PDPA.
    5. In the case of a section 26(2) application, the identity of person(s)/organisation(s) or class of persons/organisations seeking the exemption, details of the type and volume of personal data intended to be transferred, and all relevant circumstances of the transfer
    6. In the case of a section 62 application, the identity of person(s)/organisation(s) or class of persons/organisations seeking the exemption
    7. Any other supporting information and documentation

    Exemption requests will only be processed if the above information are provided. Organisations should provide exceptional and compelling reason(s), accompanied with evidence of the reason(s) why the organisation is unable to comply with the PDPA provision(s). When furnishing any information to the PDPC, an applicant may identify information that the applicant claims to be confidential information. Any such information should be clearly marked and placed in a separate annex and any claim for confidential treatment must be supported by a written statement giving reasons why the information is confidential. Please note, however, that the PDPC and its officers may disclose any matter, including matters that have been identified as confidential or matters relating to the identity of persons furnishing information to the PDPC, where necessary for the performance of their functions or discharge of their duties or where lawfully required by any court, or lawfully required or permitted under the PDPA or any other written law. In particular, please note that an exemption order made under section 62 will be published in the Gazette.

    Get in Touch

    If you have any question pertaining our PDPA course, PDPA training, DPO or consultation services, feel free to get in touch with us. We would love to help you protect your data and protect you.