COVID-19: Data Protection Advisories and Guidelines

COVID-19: A Compilation of Resources on Data Protection Advisories and Guidelines

4 May, 2021

It appears that the COVID-19 pandemic is not going away soon even as countries scramble to vaccinate their citizens. Many countries are seeing waves of infections with India now having the second-highest number of cases (more than 20 million), and hitting a record of 379,257 cases daily (as of 5 May).  In Singapore, we are seeing clusters of infection happening again, demonstrating that the guidelines, measures and contact tracing are crucial in containing any infection cluster, especially in today's interconnected world. 

Here is a compilation of resources of advisories from the Asia Pacific Privacy Authorities, the forum for privacy and data protection authorities in the region.

Checklist of good data protection practices for COVID-19 management

This checklist is a consolidation of the common baseline data protection best practices relating to technologies used to manage the COVID-19 situation. It seeks to enable app developers in the Asia Pacific region to develop apps that comply with the majority of the data protection best practices in the region for the purpose of:

  • Safe Management (e.g., contact tracing, monitoring of social distancing, enforcement of stay-home quarantines, or any other form of technology developed for the purposes of safe management)

  • Remote Working/Living (e.g., video conferencing, e-commerce, and other digital transactions).

However, app developers developing apps for the region or jurisdictions should still consult the rules or advisories published by the relevant jurisdiction they are developing apps for.

Contact tracing Advisories (including apps)

Contact tracing involves systematically identifying and tracing individuals who have come into contact recently with confirmed or suspected COVID-19 cases. Once these individuals are tracked down, they will be advised or ordered to be isolated/quarantined in their own homes or at specified quarantine facilities for the period specified by the medical guidelines of that country. For contact tracing to be effective in taking individuals out of the chain of transmission, it must be carried out rapidly and expeditiously, lest these individuals who may be carriers of the virus begin to infect others in the community. Hence the importance of collecting personal data/contact information.

Education/Online learning

One of the disruptions will be regarding the education of students. To avoid a “lost generation” of education, schooling has to continue even by using online means. With regard to this, organisations have to take note of the advisories from the respective jurisdictions.

Employment/Remote work

Even under lockdown conditions businesses have to continue to function. Some of the business continuity measures have included working from home, telecommuting and "split teams".

In the midst of all these additional measures, employers still need to be mindful about their personal data protection obligations under their local data protection laws. The following are some of the guidelines:

Health/patient privacy

In the event of a COVID-19 case, the health laws and guidelines take precedence over the data protection laws in the interest of public health and safety. Relevant personal data can be collected, used and disclosed without consent during this period to carry out contact tracing and other response measures, as this is necessary to respond to an emergency that threatens the life, health or safety of other individuals.

Online security

As businesses pivot to online transactions, the use of personal data for e-commerce, work from home (WFH), online meetings and online education platforms see some 20-fold increase in usage, it is important too that organisations and individuals be mindful of the measures required in such online transactions/ engagements.

Personal information collection

Restaurants, Entertainment, Retail



These are useful guidelines and advisories drawn up to mitigate the risks of pandemic worsening. It serves organisations, stakeholders, and individuals well to heed them in a world that has seen a rising COVID-19 mortality.

Adapted from APAC with input by: Leong Wai Chong, CIPM, GRCP

The views and opinions expressed in this article are those of the author and do not necessarily reflect the official view or position of DPEXNetwork. Information and links are correct as at the point of posting.

Become a DPEX Community member to access
data protection resouces and discussions on pertinent topics now.

Access online / in-person courses and view past training records

Join lively discussions on pertinent data protection topics

Gain access to data protection research and video resources

Receive value-added data protection updates from the region

  Related Articles
COVID-19: Pandemic Data Protection Tips for Organ…

The novel coronavirus, or COVID-19, has been receiving global attention, and co…

COVID-19: The Layman's Universal Guide to Handlin…

On Wednesday, 11 March 2020, the World Health Organisation (WHO) declared COVID…

COVID-19: Data Protection Tips and Common Princip…

Here are some general tips that your organisation can follow at each stage of i…