Article 3

What it means when you sign

This article gives the Data Bureau a power to exempt some establishments from the personal data protection requirements. The Bureau may exempt establishments that do not process a large volume of personal data, from part or all of the requirements of the data protection provisions in the law. The exemption follows the standards and controls set by the executive regulations, and it is without prejudice to any other powers the Bureau has under other legislation.

The article does not itself list which establishments are exempt or what volume counts as large. Those details are left to the executive regulations. It also does not say that small establishments are automatically exempt, only that the Bureau may exempt them.

When you are about to sign a contract, this article means a business partner that handles only a small amount of personal data may or may not be exempt from some of the data protection duties, depending on a Bureau decision under the regulations. A clause that requires the other party to follow data protection rules, or promises compliance, may be affected by whether an exemption has been granted. The contract itself would not show whether an exemption exists.