Warm (occasionally sweltering) greetings from southeast Asia to all my fellow privacy pros.
Caution: Hot. The rest of this article simmers on heat-related puns, so you may wish to stop reading any further to avoid being scalded by this torrid humor.
Hot off the heels of the IAPP Global Privacy Summit 2024, Asia's trailblazing conference the IAPP Asia Privacy Forum 2024 is open for registration. Born and raised in Singapore, I am thrilled not only to be moderating a fervid panel discussing data sovereignty in Asia, but also to host our international community here in the sultry tropics.
When Greek philosopher Heraclitus quipped, "There is nothing permanent except change," he probably could not have envisaged how apt it would be in describing the mercurial flux that is the rapidly evolving privacy patchwork in the APAC region.
One of the ways in which this thermogenesis surfaces is in contract. Privacy provisions are increasingly playing a significant role not only in data sharing agreements, but also in other commercial transactions involving some form of data processing.
Typically, there is a definition for "applicable data protection laws," which may list non-exhaustively — by using the phrase "including but not limited to," for instance — several key privacy statues, including Singapore's Personal Data Protection Act, China's Personal Information Protection Law, South Korea's Personal Information Protection Act, Japan's Act on the Protection of Personal Information, Vietnam's Personal Data Protection Decree, Malaysia's Personal Data Protection Act, Indonesia's Personal Data Protection Law and Thailand's Personal Data Protection Act.
What these contracts less commonly ignite, however, is the burning question of how parties should deal with changes in any of these laws. It is no exaggeration that global privacy is red hot now, and Asia is no exception. For instance, within Southeast Asia alone, Indonesia is anticipating the imminent issuance of an implementing regulation to its PDPL, and Malaysia is expected to enact significant updates to its PDPA. Even as this writer and other digest authors strive diligently to report on "in the oven" amendments to regional laws, it is nearly impossible to track these pyretic changes exhaustively.
Yet knowing that revisions are close to a boil means preempting such changes before they are set ablaze, by planning for them properly, including within a contract. There could be a mechanism for parties to come together as and when a change arises, to discuss in good faith and/or reasonably cooperate and assist each other to ensure compliance with those revisions.
Ultimately, respecting that change is the only constant can help avoid a combustion of existing agreements, and even precipitate a half-baked relationship into a more balmy one.