Enquiry Case Notes

編號: 0625/C/2012

標題: Entity on behalf of the controller to process personal data


    Company A on behalf of Company B to process its customers’ personal data. Company A would like to enquire which of the provisions of the “Personal Data Protection Act” they need to pay special attention to when accessing the personal data?


    In the absence of detailed information about the case, which the inquirer could have provided, GPDP can only make the following guidelines on the general requirements for personal data processing:
  According to Articles 4(1)(1) and 3(1) of the Personal Data Protection Act, data processing in this inquiry is within the scope of regulation by the said Act.
  In general, according to Article 17 of the same Act, without Company B’s guidelines, Company A is not allowed to process the relevant data unless for compliance with the legal obligations.

Please refer to "Personal Data Protection Act", articles 3,4,17 .