The most important legal page you need for your mobile app

The Southeast Asian mobile app and cloud computing markets are booming, and alongside this is the increasing need to protect and safeguard the privacy of your users. Jurisdictions across Asia are introducing new Privacy laws, and as a mobile app developer you need to make sure that you comply with their requirements.

Part I of this article covered End User Licence Agreements (EULA) and Terms of Use, and how to make sure your users agree to your agreements. I will briefly recap how to get consent to your Privacy Policy at the end of this article and why that is important.

First let’s examine what a Privacy Policy is, and whether you need one.

What is a Privacy Policy?

A Privacy Policy is a legal statement that explains how customer or user data is collected, used, managed, and disclosed. The Privacy Policy also explains to the customer how their privacy and personal information will be protected.

The contents of any given Privacy Policy will depend on what country the person or company collecting the information is in, what country the users are in, what information is being collected, and what that information is used for.

So do I need one?

If your app collects any data about your users at all, the law in most countries requires that you must have one. Both the Google Play Store and the Apple iStore require any apps that you sell through their stores to have a Privacy Policy.

To date only three Southeast Asian countries have passed comprehensive privacy laws. Malaysia was one of the first, when it passed privacy legislation in 2010, with the Philippines and Singapore following in 2012. Other countries in the region such as Indonesia and Vietnam have partial privacy legislation in place, while others are still developing.

Malaysia and Singapore follow the English common law, and have based their legislation on English law. The Philippines includes a number of privacy principles in its legislation, the Data Privacy Act of 2012, which are also similar to the EU privacy principles.

If you have any customers internationally, you should make sure that you comply with the laws of the major jurisdictions around the world, such as the US, the UK, the EU, and Canada.

What needs to go in my Privacy Policy?

The main principles that are enshrined by privacy laws around the world are:

• Give notice;
• Obtain consent;
• Collect the information for a fair and lawful purpose;
• Keep the information secure;
• Do not disclose unless necessary, and notify the individual of when their data will be disclosed;
• The information collector must be able to be held accountable;
• The information should be kept accurate and up to date;
• Information collected should be adequate and not excessive; and
• The individual must have access to the information.

In particular, Southeast Asian jurisdictions such as Singapore and the Philippines require that the data collected must be “reasonable” in the circumstances and not excessive.