Privacy laws in Australia, Malaysia, India and Indonesia
If you sell to, serve or employ people in Australia, Malaysia, India or Indonesia, their privacy laws may apply to your Singapore business. We check which laws apply, compare your practices with each, and help you close the gaps. These are laws, not certifications: you comply, and each regulator enforces.
Who it is for
Singapore organisations with offices, staff, customers or service providers in these countries, such as clinic groups, logistics firms and software companies. Data protection officers get one gap list across the four laws, alongside their Personal Data Protection Act (PDPA) work.
Who does what
- You
You tell us where you operate and share your data flows, notices and contracts.
- Us: we check and prepare you
We check which laws apply, assess the gaps and help you fix notices, contracts and steps.
- The regulator
Each country’s regulator enforces its own law. No single certificate covers all four.
Four laws, side by side
Australia: Privacy Act 1988 and the Australian Privacy Principles
When you carry on business in Australia, for example through an office, staff or agents there, and your annual turnover is above A$3 million; some smaller firms are also covered.
- Follow the 13 Australian Privacy Principles (APPs) on collecting, using and sharing data
- Keep personal information secure, and take care before disclosing it overseas
- Tell the regulator and affected people about breaches likely to cause serious harm
Source: Office of the Australian Information Commissioner (OAIC): The Privacy Act (opens in a new tab)
Malaysia: Personal Data Protection Act 2010, as amended
When your business is established in Malaysia, such as through a branch or subsidiary, or uses equipment there to process personal data in commercial transactions.
- Appoint a data protection officer if you pass a threshold, such as 20,000 people’s data
- Tell the Commissioner of a breach within 72 hours, and affected people where harm is likely
- Meet the conditions before sending personal data out of Malaysia
Source: Personal Data Protection Department (JPDP), Malaysia (opens in a new tab)
India: Digital Personal Data Protection Act 2023 and its Rules
When you process digital personal data in India, or process it abroad in connection with offering goods or services to people in India.
- Give a clear notice and get valid consent, unless another lawful use applies
- Protect data with reasonable safeguards, and tell the Board and affected people of breaches
- Plan ahead: the Rules, notified in November 2025, phase in over 18 months
Source: Press Information Bureau, Government of India: DPDP Rules, 2025 (opens in a new tab)
Indonesia: Personal Data Protection Law (Law No. 27 of 2022)
When you process personal data in Indonesia, or abroad where the processing has legal effects in Indonesia or on Indonesian citizens.
- Have a lawful basis, such as explicit consent, for each use of personal data
- Notify affected people and the authority in writing within 3 x 24 hours of a breach
- Prepare for Government Regulation No. 33 of 2026, in effect from 16 January 2027
Source: PwC Indonesia: Government Regulation 33/2026 on Personal Data Protection (opens in a new tab)
Australia’s Privacy Act 1988 allows penalties of A$50 million or more for serious interference with privacy. OAIC.
Common questions
Does a foreign privacy law apply to my Singapore business?
It can. Australia’s law reaches firms that carry on business there. India’s covers processing linked to offering goods or services to people in India. Indonesia’s covers processing with legal effects there. Malaysia’s covers firms established, or using equipment, there.
Can we get certified for these laws?
No. These are laws, not certification schemes: you comply, and the regulator enforces. Where a recognised certification exists in a country, we tell you. Our written gap assessment records what you checked and fixed.
We already comply with Singapore’s PDPA. Is that enough?
It is a strong start, because the principles overlap. Each law adds its own rules, such as breach deadlines, data protection officer duties and conditions for sending data abroad. The gap assessment shows where they differ.
How much does a check cost?
The fee depends on how many of the four laws apply and how many systems and data flows are in scope. You get a fixed-fee proposal after a short scoping call.
Privacy work is led by a Certified Information Privacy Manager (CIPM), issued by the IAPP.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)