Personal Data Protection

Personal Data Protection Compliance — Layered Reference

⚠ Reference material, not legal advice

This skill is engineering reference material, not legal advice. The maintainers and contributors are not licensed to practise law in Singapore, Thailand, Indonesia, Malaysia, the Philippines, Vietnam, or any other jurisdiction. No attorney–client relationship is created by use of this skill.

Do not rely on this skill as your sole source of truth for personal-data-protection compliance. Always (a) verify any statute citation, threshold, or obligation against the official source, and (b) engage a qualified Data Protection Officer or privacy lawyer before making compliance decisions that materially affect your obligations or your users' rights.

Source-text posture: this skill does not reproduce or republish any of the underlying statutes. It provides engineer-facing interpretation and short attributed quotations of operative phrases under fair-dealing principles, with links to the official sources. Anyone planning to package or redistribute the content beyond similar engineering-reference use should read DISCLAIMER.md § Copyright in source materials — Malaysia's PNMB-published Act 709 / Act A1727 carry the strictest publisher's notice of the populated jurisdictions and may require prior permission.

By using this skill you accept the full disclaimer in DISCLAIMER.md, including the "use at your own risk" terms and the maintainers' zero liability for any decision taken in reliance on this content.

This skill helps engineers ship features that comply with personal-data-protection statutes in Singapore, Thailand, Indonesia, Malaysia, the Philippines and Vietnam. It is organised by where in the stack the obligation lives rather than by statute section number — engineers shouldn't need to learn statute references to do their job.

Step 1 — Identify the active jurisdiction(s)

On first use in a project, check for .pdp-compliance.json at the project root. If present, use personalDataProtection.jurisdictions and load only the matching jurisdictions/<code>/README.md files. If absent, ask the user which jurisdiction(s) apply. The answer depends on where the application's users are located, not where the company is registered.

"Which personal-data-protection regimes does this application need to comply with? Pick all that apply: Singapore (PDPA 2012), Indonesia (UU PDP 27/2022), Thailand (PDPA B.E. 2562), Malaysia (PDPA 2010 with 2024 Amendments), Philippines (DPA / RA 10173), Vietnam (PDPL 91/2025/QH15). If users span multiple jurisdictions — and note Vietnam applies to Vietnamese citizens wherever they are —, pick all relevant — the strictest rule will usually win."

Once selected, suggest creating .pdp-compliance.json in the project root so future sessions and local guardrails do not need to re-ask:

{
  "personalDataProtection": {
    "jurisdictions": ["sg-pdpa"],
    "mode": "strictest-wins",
    "reviewPolicy": "warn"
  }
}

Then load only the relevant jurisdictions/<code>/README.md files. Cross-jurisdiction comparison lives in jurisdictions/_index.md.

Codes: sg-pdpa, th-pdpa, id-pdp, my-pdpa, ph-dpa, vn-pdpl — all populated. Per-jurisdiction status and the full comparison grid live in jurisdictions/_index.md.

Once the user has chosen, persist that choice in .pdp-compliance.json when the project allows file changes. If the project cannot accept that file, persist the choice somewhere project-specific (a comment in the project's AGENTS.md, CLAUDE.md, or equivalent project-instruction file) so subsequent sessions don't need to re-ask.

Step 2 — Pick the right entry point

You're starting work on something. Open the matching checklist:

You want depth on a specific layer. Open the matching layer file:

Layer files are universal across all populated jurisdictions — implementation patterns are shared. Jurisdiction-specific obligations live in jurisdictions/<code>/obligations/.

Jurisdiction files

Once the active jurisdiction is known, open its files directly from this table rather than following links from one file to the next. Each README.md states scope, statute version and verification date; statute-map.md maps sections to layers; the obligation files hold the per-statute rules.

Templates to copy into a project: INCIDENT_RESPONSE.md.template (breach runbook) and pdp-nudge.sh.template (changed-file reminder hook).