CIPP/A: Certified Information Privacy Professional/Asia

PDPO section 63B permits limited personal-data disclosure or transfer for a due-diligence exercise connected with a proposed business transaction, such as a transfer of business or shares, a change in shareholdings, or an amalgamation. It therefore covers assessing the viability of mergers and similar corporate transactions.

The first recommended step in the 2015 guidance is to promptly gather essential information about the breach. That information supports assessment of the impact on affected data subjects and selection of appropriate mitigation measures. PCPD: Guidance on Data Breach Handling and the Giving of Breach Notifications

GDPR Article 9 treats data concerning health, racial or ethnic origin, and political opinions as special categories of personal data. Financial information is personal data, but it is not included in Article 9’s special-category list.

Health information is widely classified as sensitive personal data because disclosure or misuse can lead to discrimination, stigma, or other significant harm. Official privacy guidance in Malaysia expressly includes information about an individual’s health or physical or mental condition as sensitive personal data, and Japan’s data-protection rules classify medical history as specially protected personal information.

Access and correction is not an absolute right. A request may be denied when complying would create an unreasonable or disproportionate expense or burden for the personal information controller.