Adobe Transfer Impact Assessment

Adobe Data Transfers to Third Countries – Customer Guide

Adobe has prepared this guide to provide information for its business customers in Europe that may be performing a data ‘transfer impact assessment’ (“TIA”) as part of their due diligence process in contemplation of using Adobe products and services.

This guide has been developed in consultation with specialist data protection and privacy lawyers in each of the countries below regarding the laws and practices in those countries in relation to government and law enforcement access to personal data. This guide is based on Adobe’s own analysis and takes into consideration relevant decisions by the Court of Justice of the European Union ("CJEU") including the recent ‘Schrems II’ decision, as well as guidance from data protection authorities such as the European Data Protection Board ("EDPB"). The information is supplied here in a summary form.

Why is this necessary?

European data protection laws restrict the transfer of personal data to ‘third countries’ unless the recipient country has been deemed ‘adequate’, or the data exporter has ensured there are appropriate safeguards in place to provide the personal data with an adequate level of protection. One of those safeguards, which Adobe relies upon, is to use ‘standard contractual clauses’ ("SCCs") as follows:

- in respect of EU personal data, the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission under Implementing Decision (EU) 2021/914 of 4 June 2021 (“EU SCCs”);

- in respect of UK personal data, the International Data Transfer Addendum to the EU SCCs, issued by the UK Information Commissioner and laid before Parliament in accordance with s.119A of the Data Protection Act 2018 on 2 February 2022; and

- in respect of Swiss personal data, the EU SCCs as amended to comply with Swiss law requirements.

After a court decision in the EU known as ‘Schrems II’, the CJEU decided that, before using SCCs, companies should assess the risk of government access to personal data in the recipient country and implement additional safeguards as needed.

Adobe transfers personal data to third countries as set out in the description of transfers sections below. Adobe has evaluated the impact of the ‘Schrems II’ decision and has taken necessary steps, aligning its data protection processes and standards to address compliance. This guide summarizes the information from Adobe’s transfer impact assessments and describes the additional safeguards which Adobe has implemented.

Important:

This document is (1) intended to support the business customer with conducting its own TIA; and (2) states Adobe’s summary and conclusion of its own TIA which it has conducted as a data exporter.

It is not provided as legal advice. The third countries covered by this guide are:

A. Armenia
B. Australia
C. India
D. Serbia
E. United States
F. Singapore
G. Indonesia
H. Malaysia

A. ARMENIA

DESCRIPTION OF TRANSFERS

I. Summary

Personal data in the form of Business Contact Data/Customer Content Data as described further below will be accessed by Adobe Development ARM LLC in Armenia - this entity performs customer support functions on behalf of Adobe affiliates based in the European Economic Area ("EEA").

The level of rule of law and respect for human rights in Armenia is intermediate: whilst basic rights and freedoms (such as right to a fair trial, right to protection of personal data etc.) are recognized under the Armenian Constitution and laws, the Armenian judiciary does not enforce these rights at an appropriate level due to e.g. inconsistent legal interpretation, overburdened courts, long duration of court cases and alleged cases of corruption. The independence of Armenian courts and judges is guaranteed under the Armenian Constitution and the Judicial Code of Armenia, but in practice the Armenian courts do not always exhibit independence.

Armenia has data protection legislation which includes various protections as well as rights for individuals. There is independent oversight in the form of a national data protection supervisory authority. Individuals also have limited rights to compensation in the form of damages for breach of their data protection rights via the Armenian courts; however, in practice this may not be an effective remedy for the reasons stated above.

Armenian legislation sets out specific legal bases authorizing investigative authorities to access personal data pursuant to statutory procedural requirements in case of any type of criminal investigation although the new Armenian Criminal Procedure Code specifies new categories of secret investigative actions (such as surveillance, wiretapping, supervision of financial transactions etc.) which may only be conducted where crimes involving corruption and other serious crimes are involved.

There are restrictions on requirements to notify affected individuals of access to their personal data in some cases e.g. if there is a lawful request from Armenian authorities to access personal data (i.e. in performance of their administrative functions), notification to the data subject is not required. The Armenian Criminal Procedure Code also prohibits notification in certain circumstances. Requests by authorities to access certain types of personal data are subject to judicial warrants.

Adobe has concluded that the relevant laws in Armenia that may permit government access to personal data offer a lower level of protection than that guaranteed within the EU and cause risks for the exported data that cannot be fully accounted for by the SCCs, particularly with regard to the lack of a fully independent oversight mechanism and of remedies available for affected individuals. However, the risk of the personal data in question being accessed by public authorities in Armenia is theoretical rather that practical and indeed Adobe Development ARM LLC has never received a request from Armenian authorities seeking access to user data. To further address the residual risks, Adobe has implemented additional technical, organizational, and contractual supplementary measures to ensure that the data accessed from Armenia benefits from a level of protection that is adequate in relation to that of the EU.

II. Personal Data Affected

The personal data transferred to Armenia is as follows:

Business Contact Data:

Contact details provided in the customer support request handled by the data importer and other details accessed by the data importer for verification and support purposes including:

Name, contact details, organizational name and contact details.
Details of customer support provided (e.g. details of raising and responding to customer support cases).

Customer Content Data:

Customer or end user content which may contain some personal data which may be incidentally accessed when the data importer’s staff are granted access by the end user so that 3rd tier support services can be provided for their use of Workfront, a work management tool that includes projects, tasks, documentation, reports team information etc. Access is limited to customer and any end user data that is stored in the Workfront product environment, and the environment accessed will be specific to the product to which the support request relates e.g. Fusion, Proof etc. Such access is time-limited.

LEGAL ASSESSMENT

I. General Approach to the Rule of Law and Human Rights

In general, the level of rule of law and respect for human rights in Armenia is intermediate. While basic rights and freedoms (such as property ownership, respect for human life, right to a fair and public trial, right to protection of personal data etc.) are recognized under the Armenian Constitution and laws, the judiciary does not enforce these rights at an appropriate level due to e.g. inconsistent interpretation of the law, Armenian courts being overburdened, the length of time it takes for court cases to reach a conclusion and alleged cases of corruption.

The National Assembly of Armenia (legislature) has ratified a number of international treaties aiming at protection of human rights. Armenia is a party to the Convention for the Protection of Human Rights and Fundamental Freedoms and to the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data. Armenia also ratified the Additional Protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, regarding supervisory authorities and transborder data flows (ETS No. 181) and the Protocol amending the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (CETS No. 223).

Armenian courts adhere to European Court of Human Rights (“ECtHR”) case law. Under Art. 6(2) of the Judicial Code of Armenia, the courts must consider the practice of the bodies operating on the basis of international human rights treaties ratified by the Republic of Armenia (including the ECHR) when interpreting the provisions of fundamental rights and freedoms under the Constitution. It is customary for local courts to rely on ECHR case law when administering justice and to refer to ECHR decisions. However, the ECHR has found against decisions of the Armenian courts.

II. National Data Protection Law and Independent Supervisory Authority

The Armenian Constitution adopted on 6 December 2015 expressly ensures the right of any individual to the protection of his/her personal data. Armenia also adopted its Law "On Personal Data Protection" ("PDP Law") in 2015. Personal data processing includes, inter alia, access to personal data. Provision of access to personal data is permissible if a data subject gives their consent to data processing or if processing of (access to) personal data takes place by virtue of law.

In 2015, the Armenian Government established an authority within the Armenian Ministry of Justice, called the Personal Data Protection Agency of Armenia (the "Agency"), to supervise compliance with personal data protection legislation. It is an independent body, acting based on the PDP Law and the structure defined by the Armenian Government. Among other functions, the Agency is authorized to verify the compliance of personal data processing with the requirements of the data protection law, either on its own initiative or based on a relevant application, and to apply administrative sanctions in case of breach of such data protection law.

III. Identification of the Laws that Allow Government Access to Personal Data

Armenian legislation sets out specific legal bases authorizing investigative authorities to access personal data pursuant to statutory procedural requirements in case of criminal investigations. Such legal bases are incorporated in:

Law of Armenia “On Operational Intelligence Activity” (“OIA Law”);
Criminal Procedure Code of Armenia (“Criminal Procedure Code”)
Law of Armenia “On Electronic Communications”
Law of Armenia “On the Legal Regime of the State of Emergency”
Law of Armenia “On Combating Money Laundering and Terrorism Financing” (“AMLTF”); and
The new Criminal Procedure Code of Armenia entering into force in July 2022.

The above laws allowing Armenian authorities to access personal data in Armenia cover all individuals, irrespective of their citizenship or resident status (including non-Armenian residents whose data is processed by an Armenian organisation).

The above laws are generally adhered to in practice. Although illegal access to personal data by investigative and law enforcement authorities is not common in Armenia, it cannot be ruled out that authorities occasionally access personal data without satisfying the relevant legal requirements.

IV. Proportionality Assessment of Rights to Access

The Criminal Procedure Code currently in force in Armenia treats all types of crimes (whether minor or serious) in the same way in terms of access to personal data. However, the new Criminal Procedure Code defines a new category of secret investigative actions (such as internal and external surveillance, digital supervision, supervision of correspondence, wiretapping, supervision of financial transactions etc.) which may be conducted only where crimes involving corruption or other serious or particularly serious crimes are being investigated, and also provides guarantees to ensure the lawfulness of the secret investigative actions.

V. Limitations to Right of Access

In practice, public authorities in Armenia access personal data required for implementation of their administrative functions pursuant to PDP Law provisions. Although the PDP Law sets out that during investigations, national security and AMLTF operations, personal data processing matters are regulated by other laws, the law enforcement authorities and national security agencies are not excluded from the scope of regulation of the PDP Law and therefore must comply with the PDP Law to the extent it does not contradict any relevant Armenian sectorial laws (e.g. OIA Law, Criminal Procedure Code etc.).

VI. Independent Oversight and Prior Approval

The supervision of the protection of personal data in Armenia is carried out by the Agency, which is appointed as the Armenian data protection authority. It is an independent body, acting based on Armenian data protection laws and the structure defined by the Government of the Republic of Armenia. Disputes arising out of violations of data protection laws are not common in Armenia and there is no well-developed and established case law with respect to such disputes. No significant cases of data breach by Armenian authorities have been reported.

Another form of independent supervision and oversight is judicial supervision i.e. by the courts. Access to correspondence, emails and other means of communication (electronic communication systems) of an individual, access to data representing medical, notarial, insurance or banking secrets, and the wiretapping of phone calls are only possible upon prior authorization by the court. Access to these types of data by law enforcement bodies/national security agencies therefore requires prior court approval; otherwise, they do not have to seek prior court approval. There are no specific rules in Armenia for ex-post supervision or similar review of law enforcement bodies’/national security agencies’ use of their powers to access personal data in the course of investigations.

The independence of Armenian courts and judges is guaranteed under the Armenian Constitution and the Judicial Code of Armenia, but the courts do not always exhibit independence. The Report of the former Human Rights Defender of the Republic of Armenia on the Right to Fair Trial dated December 9, 2013 cited numerous cases where pressure was exerted on judges and also corruption schemes involving judges from the Armenian courts of first instance, and from the Armenian Court of Appeals and Court of Cassation. There has been improvement, relatively speaking, in the level of independence of the judiciary over recent years but Armenia does not yet have a fully independent judiciary.

VII. Transparency

Armenian law does not require an organisation to notify an individual if it receives a lawful request from Armenian authorities to be given access to that individual’s personal data. If the request is unlawful, the data subject’s prior consent is required. An organisation which receives a request from authorities to provide access to an individual’s personal data may disclose the fact of receiving the request to third parties including to the individual concerned, except where such disclosure is prohibited For example, as regards conducting investigative actions of a secret nature (e.g. wiretapping, supervision of correspondence), neither the general public, nor affected data subjects are notified of investigative bodies accessing personal data under the OIA Law or Criminal Procedure Code - control over the lawfulness of access to personal data during these investigations is maintained by prosecutors and courts.

Information on how often authorities use access powers does not appear to be publicly available.

VIII. Individual Remedies for Breach of laws

According to Article 17 of the PDP Law, if a data subject finds that the processing of his/her personal data is carried out in breach of the PDP Law or otherwise violates his/her rights and freedoms (e.g. because there has been unauthorised access to the personal data by Armenian authorities), he/she has the right to challenge the actions (or omission to act) of the processor before the Agency or through the courts.

Data subjects have a right to compensation in the form of damages in civil litigation as well. However, court remedies are not always effective for the reasons stated above. Also, under Armenian law, compensation for non-monetary damages/losses as a result of violation of data protection or other rights is not available. Under the Armenian Civil Code, only compensation for monetary damages may be awarded.

The Armenian Code on Administrative Offences (the “Administrative Code”) provides sanctions for illegal processing of personal data (including but not limited to sanctions for data breaches by state officers).

SAFEGUARDS

I. Technical & Organizational Safeguards

Adobe’s relevant Technical Measures are as follows:

The Technical and Organizational Measures for Adobe Cloud Services here: https://www.adobe.com/go/CloudSvcsTOSM.
Adobe Certifications and Security White Papers which apply to all the Cloud Services.

These measures include encryption of restricted data sets over public networks based on the specification HTTPS TLS v1.2, and at rest encrypted to specification AES-256 bit. Key management measures differ depending on the Adobe product.

Adobe's Organisational Measures include those set out in its Transparency Report and Law Enforcement Guidelines,which describe Adobe’s approach to access requests from government and law enforcement and its notice policies. Unless legally prohibited from doing so, Adobe commits to redirect requests to business customers and gives notice (enclosing a redacted copy of the request) whenever a government agency seeks access to their information. Adobe also has comprehensive internal data protection policies which address broader data protection principles such as data minimisation.

II. Contractual Safeguards

Adobe relies on the SCCs for transferring European personal data out of Europe – the modules selected by Adobe include provisions designed to address ‘Schrems II’ concerns (i.e. Clauses 14 and 15 of the EU SCCs).

Adobe requires all those who process European personal information on its behalf to execute a data processing agreement that is no less protective than that which it signs with its business customers, and which includes additional supplementary measures.

B. AUSTRALIA

DESCRIPTION OF TRANSFERS

I. Summary

Customer personal data will be transferred to Adobe Systems Pty Ltd in Australia as follows:

Business Contact Data are transferred because the Adobe affiliate in Australia performs customer support functions on behalf of Adobe affiliates based in the European Economic Area (EEA).
Personal data contained in Customer Content may be accessed when Adobe affiliates in Australia provide customer support on behalf of Adobe affiliates based in the European Economic Area (EEA).

Please see our Transparency Report for details of requests from Australian authorities seeking access to user data.

Australia has privacy legislation at both a federal, and State and Territory level, which is applicable to both state as well as non-state actors and includes a number of protections as well as rights for individuals. However, this is subject to certain exemptions for law enforcement, including restrictions on the requirement to notify affected individuals of access to their personal data.

Typically, access and surveillance requests are subject to judicial warrants or judicial authority and are subject to considerations of proportionality and the impact on individuals’ privacy.

The Australian constitution establishes the rule of law and provides checks and balances on the executive, including independent judicial oversight. Australia also has independent oversight in the form of a federal privacy regulator, as well as regulators responsible for information and privacy at a State and Territory level.

In conclusion, in practice personal data transferred to Australia is adequately protected for the following reasons:

as described above and below, Australia’s legal system strongly recognises and is built upon the rule of law, and Australia has ratified a number of relevant UN treaties as well as being an OECD member bound by OECD data protection principles;
Australia has a strong privacy law regime which binds public and private sector organisations and offers rights of appeal via an independent appeal system and (including via freedom of information laws) rights of data access and has significant oversight laws when it comes to public authority access to personal data as well as transparency regarding access.
the historic number of public authority access requests made under Australian laws is relatively low as disclosed in publicly available reports and this is reflected in Adobe’s practical experience as revealed in our Transparency Report.
we have contractual, technical and organisational security measures, including the publication of the Adobe Transparency Report and Law Enforcement Guidelines, that adequately compensate for any failure (if any) of the rights of public authorities to access personal data to fully meet EEA requirements.

II. Personal Data Affected

The personal data transferred to Australia is contained in the following data categories:

Business Contact Data (user related)

Name, contact details, organisational name and contact details, credentials received from social networking sites.
Information processed to deliver services (e.g., IP address, device and browser type, account ID information) or about a user’s interaction with Adobe online.
Details of the marketing promotions which have been sent to, or viewed by, the recipient and how the recipient interacted with these.
For users who are individuals: date of birth, details of services supplied and eligibility for discounted services, billing and payment information.

Customer Content as defined in the Adobe General Terms and Terms of Use:

Personal details and contact information including name, address, email address, title, position, contact information, social profile information, IP address, unique user IDs (such as cookie IDs) and marketing profiles.
Documents and Content: Documents, images, and content uploaded to the Adobe Cloud services in electronic form which may contain any type of personal data.

Customer Data as defined in the General Terms (enterprise customers only).

LEGAL ASSESSMENT

I. General Approach to the Rule of Law and Human Rights

Australia is a constitutional monarchy based on the English Westminster system. Its constitution codifies a rule of law under which the judiciary, legislature and executive are independent (i.e. there is a separation of powers) which allows for checks and balances on the use of power and ensures the courts remain independent. Australia’s constitution provides for certain fundamental rights and freedoms, and the protection of personal information is acknowledged in the Privacy Act 1988 ("Privacy Act").

Administrative decisions of the executive authorities can be judicially reviewed through the courts, a mechanism which also allows individuals to seek the enforcement and protection of their rights.

Australia is a signatory to various relevant international commitments, including the Universal Declaration of Human Rights 1948.

II. National Data Protection Law and Independent Supervisory Authority

At a national level, Australia’s Privacy Act and Australian Privacy Principles regulate the collection, use and disclosure of personal information by Commonwealth government agencies (as well as private sector organisations that meet a financial threshold criteria).

Although the Privacy Act does not apply to State and Territory governments, similar protections are provided in State and Territory laws (described below).

The Office of the Australian Information Commissioner (OAIC) is the independent national privacy regulator responsible for regulating compliance with the Privacy Act by Commonwealth government agencies and organisations. The OAIC can conduct investigations, handle complaints and take enforcement action. States and Territories also have information or privacy commissioners that administer State and Territory privacy laws.

III. Identification of the Laws that Allow Government Access to Personal Data

The main laws that authorize law enforcement or national security agencies to access data are:

The Privacy Act and the Australian Privacy Principles ("APPs");
Relevant State and Territory privacy laws including the Information Privacy Act 2014 (ACT), Privacy and Personal Information Protection Act 1998 (NSW), Privacy and Personal Information Protection Act 1998 (NSW), Information Act 2002 (NT), Information Privacy Act 2009 (Qld), Personal Information Protection Act 2004 (Tas), Privacy and Data Protection Act 2014 (Vic), Freedom of Information Act 1992 (WA) and the South Australian Information Privacy Principles;
The Surveillance Devices Act 2004 (and relevant State and Territory acts);
Australian Security Intelligence Organisation Act 1979;
Crimes Act 1914;
ASIC Act 2001;
Telecommunications (Interception and Access) Act 1979;
Telecommunications Act 1997 (in particular Part 15);
Security of Critical Infrastructure Act 2018;
Mutual Assistance in Criminal Matters Act 1987.

IV. Proportionality Assessment of Rights to Access

Public authorities do not have a general discretion to access data. Access generally requires the issue of a warrant or authorization which will only be granted if the information sought is required to prevent or investigate and offence or is a national security matter.

The relevant legislation provides considerations that must be taken into account when a warrant or authorization is considered, and typically this includes consideration of the potential interference with individuals’ right to privacy, the gravity of the conduct being investigated, likelihood of information furthering the investigation and whether there is an alternative method of obtaining the evidence and whether doing so would be detrimental to the investigation.

V. Limitations to Right of Access

The Privacy Act imposes a number of exceptions to normal privacy rules in respect of certain ‘enforcement bodies’, including exempting certain bodies from parts of the rules when they reasonably believe that the use or disclosure of personal data is reasonably necessary for certain enforcement related activities. There are similarly exceptions for cross-border disclosures where the disclosing entity is an agency (including government agencies and public bodies).

Outside of these exemptions and exceptions, the following rules generally apply:

APP 3 requires that entities and agencies only collect personal data (other than sensitive data) where it is reasonably necessary for or (in the case of agencies) directly related to, one or more of the entity’s functions or activities.
APP 5 requires the entity to take reasonable steps to notify the individual of certain matters, including, where the collection is required or authorised by or under an Australian law or a court order—the fact that the collection is so required or authorised (including the name of the Australian law or details of the order that requires or authorises the collection).
Limitations on the use or disclosure of personal data for a secondary purpose.
APP 11 requires entities and agencies to take reasonable steps to protect personal data it holds from misuse, interference and loss, unauthorised access, modification or disclosure.

The entities may also be subject to other mandated privacy rules, for example those required to be imposed by the responsible Minister in relation to the Australian Secret Intelligence Service, the Australian Geospatial-Intelligence Organisation and the Australian Signals Directorate, or internal guidelines developed relating to privacy, for example the NSW Police Force Privacy Management Plan.

State and Territory police are subject to state and territory legislation, which generally contains broad law enforcement exemptions. For example, NSW Police are subject to the Privacy and Personal Information Protection Act 1998 (NSW), which contains an exemption in relation to activities other than its educative and administrative functions.

VI. Independent Oversight and Prior Approval

As the laws governing access vary by state and territory, there are various bodies and mechanism that provide oversight – but there are certain safeguards, controls and reporting requirements in each case. In general, the use of surveillance, access or coercive powers is subject to the issue of a warrant by a judicial officer or is subject to judicial review if issued by the executive – in each case providing court oversight.

The Office of the Australian Information Commissioner ("OAIC") is the independent national privacy regulator responsible for regulating compliance with the Privacy Act by Commonwealth government agencies and organisations. The OAIC can conduct investigations, handle complaints and take enforcement action. States and Territories also have information or privacy commissioners that administer State and Territory privacy laws.

VII. Transparency

The level of transparency will depend on the circumstances – for example, covert search warrants can be exercised without notice to the individual. However, Adobe understands that in most cases the individual will not be informed prior to the search, and that after a search has been conducted, it is common for there to be restrictions on the giving of notice to the individuals affected.

Typically, organisations (including Adobe) that receive requests to provide personal data to authorities publish details about the frequency and volume of receipt of such requests.

VIII. Individual Remedies for Breach of Laws

Individuals can lodge complaints with the OAIC for breaches of the Privacy Act, and seek remedies including compensation.

The TIA Act and Surveillance Devices Act set out civil remedies for individuals where there has been unlawful access to their personal data causing loss.

Individuals may also have a right to judicial review of a decision relating to surveillance and data access and can make complaints directly to the relevant body or commission or they can seek civil compensation via the courts.

IX. Data Subjects Right to Access, Erase or Correct Personal Data

APP 12 gives individuals a right of access from Commonwealth agencies and organisations (and tis right is also reflected in State and Territory laws). APP 13 gives individuals the right to request correction of their personal data. There is no right under the APPs to request erasure, but under APP 11, Commonwealth agencies and organisations are required to delete or de-identify personal data once it is no longer needed for a permitted purpose.

SAFEGUARDS

I. Technical & Organisational Safeguards

Adobe’s relevant Technical Measures are as follows:

The Technical and Organisational Measures for Adobe Cloud Services here: www.adobe.com/go/CloudSvcsTOSM.
Adobe Certifications and Security White Papers.

These measures include encryption of restricted data sets over public networks typically based on the specification HTTPS TLS v1.2, and at rest encrypted to specification AES-256 bit. Key management measures differ depending on the Adobe product.

Adobe’s Organisational Measures include those set out in its Transparency Reportand Law Enforcement Guidelines,which describe Adobe’s approach to access requests from government and law enforcement and its notice policies. Unless legally prohibited from doing so, Adobe commits to redirect requests pertaining to business customers and gives notice (enclosing a redacted copy of the request) whenever a government agency seeks access to their information.

Adobe also has comprehensive internal data protection policies which address broader data protection principles such as data minimisation.

II. Contractual Safeguards

Adobe relies on the SCCs for transferring European personal data out of Europe.

Adobe requires all its vendors who process European personal information on its behalf to execute a data processing agreement that is no less protective than that which it signs with its business customers, and which includes additional supplementary measures.

C. INDIA

DESCRIPTION OF TRANSFERS

I. Summary

Customer personal data will be transferred to Adobe Systems India Private Ltd in India as follows:

Business Contact Data are transferred because Adobe affiliates in India perform customer support functions on behalf of Adobe affiliates based in the EEA.
Personal data contained in Customer Content may be accessed when Adobe affiliates in India provide customer support on behalf of Adobe affiliates based in the EEA).

Please see our Transparency Report for details of requests from Indian authorities seeking access to user data.

India is developing a new, comprehensive data protection law (currently in the form of a Bill), which will be applicable to both state as well as non-state actors and will replace existing privacy rules. However, this new Bill confers powers on the Central Government to exempt any agency of the Government from the application of its provisions.

Fundamentally, the Indian Constitution establishes the rule of law and protects various fundamental rights of individuals, including the right to privacy and the right to constitutional remedies to enforce fundamental rights.

The rights of access, including intercepting and monitoring of communications, by government agencies/bodies are generally authorized by the agency/body itself and not by an independent judicial body. There are limits on the exercise of such interception powers, including that such powers may be deployed only in certain circumstances, such as the occurrence of any public emergency or in the interest of public safety.

Adobe has concluded that the relevant laws in India that may permit government access to personal data offer lower levels of protection than what is guaranteed within the EU and causes risks for the exported data that cannot be fully accounted for by the SCCs. To further address the residual risks, Adobe has implemented additional technical, organisational, and contractual supplementary measures to ensure that the data benefits from a level of protection that is adequate in relation to that of the EU.

II. Personal Data Affected

The personal data transferred to India is contained in the following data categories:

Business Contact Data (user related)

Name, contact details, organisational name and contact details, credentials received from social networking sites.
Information processed to deliver services (e.g., IP address, device and browser type, account ID.
information) or about a user’s interaction with Adobe online.
Details of the marketing promotions which have been sent to, or viewed by, the recipient and how the recipient interacted with these.
For users who are individuals: date of birth, details of services supplied and eligibility for discounted services, billing and payment information.

Customer Content as defined in the Adobe General Terms and Terms of Use:

Personal details and contact information including name, address, email address, title, position, contact information, social profile information, IP address, unique user IDs (such as cookie IDs) and marketing profiles.
Documents and Content: Documents, images, and content uploaded to the Adobe Cloud services in electronic form which may contain any type of personal data.

Customer Data as defined in the General Terms (enterprise customers only).

LEGAL ASSESSMENT

I. General Approach to the Rule of Law and Human Rights

The Indian Constitution establishes the rule of law and protects various fundamental rights of individuals, including the right to privacy and the right to constitutional remedies to enforce fundamental rights. It also provides for the legislative oversight over executive action by recognizing a bicameral national legislature and state legislatures, and an independent judiciary with the power of judicial review of executive action.

II. National Data Protection Law and Independent Supervisory Authority

The 2019 Personal Data Protection Bill ("PDP Bill"), which provides for the establishment of a Data Protection Authority, is currently under review by a Joint Parliamentary Committee, and yet to be tabled before Parliament.

The current applicable privacy framework in India is contained in the Information Technology (Reasonable security practices and procedures and sensitive data or information) Rules, 2011 framed under the Information Technology Act 2000. There is no single independent data protection supervisory authority in India as at the date of this guide.

III. Identification of the Laws that Allow Government Access to Personal Data

The main laws that authorize the Government of India and/ or State Government(s) to access data are:

The Information Technology Act 2000 (“IT Act”);
The Information Technology (Procedures and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 (“Interception Rules”);
The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 (“SPDI Rules”); and the Personal Data Protection Bill, 2019 (PDP Bill) after it replaces the SPDI Rules;
The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (“Intermediary Rules”);
The Indian Telegraph Act, 1885 (“Telegraph Act”);
The Indian Telegraph Rules, 1951 (“Telegraph Rules”);
The Criminal Procedure Code, 1973 (“CrPC”).

IV. Proportionality Assessment of Rights to Access

The conditions for access to data under the IT Act and the Telegraph Act are predominantly limited to public interest grounds such as the maintenance of public safety, national security, prevention of offences, friendly relations with other countries, or for preventing incitement to the commission of an offence. However, there is no statutory mandate to restrict/limit the amount of data sought to be accessed, only to what is strictly necessary to achieve the stated public interest objectives.

V. Limitations to Right of Access

All directions and orders for the exercise of such rights should be issued only by designated authorities under the applicable laws, recorded in writing, and accompanied by reasons to be recorded in writing. As a rule, directions or orders for the interception, monitoring, or decryption of information under the IT Act should only be issued by the designated authority when it is not possible to acquire the information by any other reasonable means. The laws also require that all records pertaining to directions for interception, monitoring, or decryption and the information obtained through such requests, shall be destroyed by the security agency every six months except where likely to be required for functional purposes.

The Indian Constitution also offers a general overarching protection that any restriction of the constitutional right to privacy must be made only in accordance with the procedure established by law.

VI. Independent Oversight and Prior Approval

Only a competent authority (usually a high-ranking civil servant) may issue an order for access under the IT Act and Telegraph Act. There is also provision for a review committee to review authorizations granted by the competent authority. However, neither the competent authority nor the review committee are independent of the government.

VII. Transparency

Typically, all interception requests made by government agencies are confidential. However, organisations that receive a request to provide personal data from government agencies have been known to publish details about the frequency and volume of receipt of such requests. Adobe does this as well.

VIII. Individual Remedies for Breach of Laws

Availability of redress from an independent court/tribunal is available but limited in scope. Individuals (including non-citizens) have the right to appear before a Court to challenge an order for data access to the extent that it implicates their personal data, by asserting their constitutional right to privacy. However, judicial review in such cases is limited to a review as to whether due process was followed in making the order for access.

Additionally, the PDP Bill envisages the setting up of an Indian Data Protection Authority, which shall have the powers to monitor and enforce compliance with the provisions of the PDP Bill.

IX. Data Subjects Right to Access, Erase or Correct Personal Data

The PDP Bill will provide individuals with the right to request access, correction and restriction from the continued disclosure of their personal data and will apply to both state as well as non-state actors.

Currently, the framework under the SPDI Rules only provides rights against private corporations.

SAFEGUARDS

I. Technical & Organisational Safeguards

Adobe’s relevant Technical Measures are as follows:

The Technical and Organisational Measures for Adobe Cloud Services here: www.adobe.com/go/CloudSvcsTOSM.
Adobe Certifications and Security White Papers.

Adobe’s Organizational Measures include those set out in its Transparency Report and Law Enforcement Guidelines, which describe Adobe’s approach to access requests from government and law enforcement and its user notice policies. Unless legally prohibited from doing so, Adobe commits to redirect requests pertaining to business customers and gives notice (enclosing a redacted copy of the request) whenever a government agency seeks access to their information.

Adobe also has comprehensive internal data protection policies which address broader data protection principles such as data minimisation.

II. Contractual Safeguards

Adobe relies on the SCCs for transferring European personal data out of Europe.

D. Serbia

DESCRIPTION OF TRANSFERS

I. Summary

Adobe’s Customer Contact Data (i.e. contact details for Adobe customers) and Business Contact Data (i.e. contact details for those providing goods/services to Adobe) will be transferred to two third-party suppliers with operations in Serbia to enable them to provide mobile communication services to Adobe including the provision of identity and SMS authentication services for certain Adobe products.

Serbia has ratified most international conventions regulating protection of the rule of law and human rights, including in relation to the protection of personal data. Serbia’s new data protection law is largely aligned with the General Data Protection Regulation ("GDPR"). However, certain other Serbian laws allow broad powers for certain authorities to require disclosure of, or obtain direct access to, personal data in the possession of private parties, some of which laws are yet to be fully aligned with Serbian data protection law. However, these powers are conditional upon the authorities following strict procedures, with several layers of oversight and control including data subjects being entitled to challenge the legality of the authorities’ activities via the Serbian data protection authority and the courts.

Serbia recognises the rule of law as a basic principle of the Serbian Constitution and the Serbian legal system. However, in practice, some concerns remain regarding the appropriate implementation of the rule of law and the level of judicial independence and protection of fundamental human rights in Serbia.

II. Personal Data Affected

The personal data involved are name, mobile phone number, SMS delivery date and status in the following data categories:

Customer Contact Data (i.e. contact details for Adobe customers which includes consumer clients, employees of enterprise customers and other signers of documents); and

Business Contact Data (i.e. contact details for those providing goods/services to Adobe)

LEGAL ASSESSMENT

I. General Approach to the Rule of Law and Respect for Human Rights

The Serbian Constitution expressly states that the rule of law is a "basic precondition" of the Constitution and that the rule of law shall be achieved through free and direct elections, constitutional guarantees of human and minority rights, separation of powers, an independent judiciary and compliance with the Constitution and law. However, in practice, the rule of law is not strong in Serbia - the Serbian judicial system can often be put under political pressure by other (executive and legislative) branches of government.

Serbia has ratified the ECHR and any decision of the Serbian courts having reviewed an act of the executive may be challenged before the ECtHR. The ECtHR does not frequently overturn the decisions of the Serbian courts and such ECtHR rulings rarely find any violation of the right to fair trial in Serbia (i.e. the right which corresponds to the ECHR principle of judicial independence).

Serbia is an EU candidate country but Serbian law is not yet harmonised with EU law and standards. The Serbian government has initiated the harmonisation process and is required to complete it by 9 February 2023 but there is some doubt as whether this will occur.

II. National Data Protection Law and Independent Supervisory Authority

Processing of personal data in Serbia is mainly regulated by the Personal Data Protection Law ("DP Law") which came into force on 21 August 2019 and follows the GDPR to a large extent. Serbia also has independent oversight in the form of a national data protection authority, the Commissioner for Information of Public Importance and Personal Data Protection) ("DPA").

III. Identification of the Laws that Allow Government Access to Personal Data

The key Serbian laws that empower law enforcement authorities and national security authorities to demand disclosure of or obtain direct access to personal data in the possession of private parties are the Criminal Procedure Code ("CP Code"), the Electronic Communications Law ("EC Law") and the national security laws (i.e the Law on Security Information Agency ("SIA Law") and the Law on Military Security Agency and Military Intelligence Agency ("MSA/MIA Law")). These laws provide the authorities with broad investigative powers, but these powers are conditional upon them following strict material and procedural rules, and several layers of oversight and control are also introduced over these activities.

1. EC Law: The EC Law enables law enforcement authorities (i.e. the courts, public prosecutors and the police) and national security agencies (the Security Information Agency ("SIA") and the Military Security Agency ("MSA")) to request "Retained Metadata" from electronic communications providers and/or to perform lawful interception of electronic communications that reveals the contents of communications, if such provision/access/interception is necessary for conducting criminal proceedings or the protection of national security.

2. CP Code: The CP Code is the key law regulating the conditions and procedure under which Serbian law enforcement authorities may compel the disclosure of personal data from private parties for the purposes of criminal investigations and the conduct of criminal proceedings. It contains the provisions regulating authorities’ access to the Retained Metadata and performance of lawful interception of electronic communications (which apply together with the provisions of the EC Law noted above). It also regulates how other surveillance-related "special evidentiary actions" are to be performed (including e.g. surveillance of the electronic address of a suspect etc.). Special evidentiary actions can only be ordered by a court in very limited circumstances in respect of a person suspected of the preparation or commission of a "particularly dangerous criminal offence" (e.g. organized crime, terrorism, offences against national security etc.).

3. SIA Law: SIA’s primary mission is to protect national security, detect and prevent activities aimed at undermining or disrupting the constitutionally defined order, and to research, process and assess the security-intelligence data and information significant for national security. In order to request access to Retained Metadata or perform lawful interception of electronic communications (or perform other so-called secret/special measures which might include data access), SIA must obtain a court order.

While the conditions for the court to order the disclosure of/access to Retained Metadata are the same as under the EC Law, the lawful interception of electronic communications (and other secret/special measures) may only be ordered if:

a) there are grounds for suspicion that an individual, group or organization is conducting or preparing actions directed against national security; and

b) the circumstances of the case indicate that these actions could not otherwise be detected, prevented or proven, or that this would cause disproportionate difficulty or great danger.

4. MSA/MIA Law: The MSA/MIA Law introduces a general requirement for all state authorities and legal entities (including private entities) to provide any necessary help to MSA/MIA’s officials for the performance of tasks within their competence (namely for the MSA, to ensure security and counterintelligence protection of the Ministry of Defence and the Serbian Army, and for the Military Intelligence Agency ("MIA") to conduct important defence intelligence activities related to foreign countries and their armed forces, international organizations, groups and individuals).

The MSA may also collect information from natural persons but only with their prior consent, while state authorities and legal entities (including private entities) are required to give access to their databases and other documentation as necessary. However, in order to request access to Retained Metadata or perform lawful interception of electronic communications (or other secret/special measures which may include access to data), MSA needs to obtain a court order. The MSA would only be authorised by a court to apply these special measures only where data cannot be collected in any other way or their collection would otherwise involve disproportionate risk to life and health of people and property, or disproportionate costs. The MIA is not authorized either to access Retained Metadata held by operators or to perform lawful interception of electronic communications; however, it can conduct other secret/special measures (such as secret acquisition of documents and objects), although these other secret/special measures should not generally include direct access to data.

There is no reason to believe that the laws listed at 1-4 above are not adhered to in practice. The legality of actions of law enforcement authorities is, in practice, often tested in court during criminal proceedings, as defendants tend to challenge the legality of such actions.

IV. Proportionality Assessment of Rights to Access

The laws listed above contain relatively clear rules as to when the data can be accessed by competent authorities and provide certain proportionality safeguards (e.g. the setting of specific time limits and the requirement to keep appropriate records referencing the document permitting such access and the relevant date and time of such access).

V. Limitations to Right of Access

Access to personal data by law enforcement authorities and/or national security agencies in Serbia under the laws described above can generally be said to be targeted (i.e. it must relate to specific individuals and not be on a scale that could be considered to be bulk/massive and disproportionate).

From a practical standpoint, the courts do appear to take care to limit their orders to data which are relevant for the specific individual/group/organization or the criminal offence/action of interest in question, and bulk data demands are generally considered disproportionate.

VI. Independent Oversight and Prior Approval

Although the laws described under V. above provide the authorities with broad investigative powers, they also introduce several layers of oversight and supervision over the authorities’ activities, such as by the courts. Court orders are often required before the authorities can proceed. The Serbian DPA also plays an important role. Under Serbian law, both the DPA and the Serbian courts are formally independent state authorities, although in practice this depends on the actual individuals assuming key positions within them.

The DPA has the general power to obtain any information in possession of the state authorities and other entities, issue warnings where their processing operations are infringing the DP Law, order the authority/entity to bring these operations into compliance with the DP Law, as well as impose a temporary or definitive limitation or ban on data processing. The only exception concerns the courts, as the DPA is not authorized to supervise the processing operations of courts when they are acting in their judicial capacity.

There are also some mechanisms in place for high-level review of the legitimacy of the actions of Serbian law enforcement authorities and national security agencies. However, these mechanisms do not focus specifically on whether authorities' powers to access personal data have been exceeded.

VII. Transparency

The CP Code, EC Law, SIA Law and MSA/MIA Law are all publicly available.

No official information is publicly available on the frequency/number of access requests and/or type of access requests for disclosure of or direct access to data by Serbian law enforcement authorities or national security agencies.

It depends on the circumstances whether a data importer in Serbia which receives a request from law enforcement authorities or national security agencies to provide access to personal data is permitted to disclose the fact/scope of that request (a) to the individual to whom the data relates; and/or (b) to the relevant data exporters (including factors such as the purpose(s) of the processing and legal ground(s) of the authorities requesting the access to the data). Secrecy is often expressly required because of the nature of the activities.

VIII. Individual Remedies for Breach of Laws

If their data have been accessed contrary to the law, data subjects (including both Serbian residents/citizens and foreign citizens) are entitled to:

file a complaint with the Serbian DPA (including in relation to public disclosure/surveillance activities);
file a complaint against any authority issuing a problematic demand/order, to be submitted to its superior or other competent person (i.e. to the president of the relevant court/the Public Prosecutor’s office/Ministry of Interior Affairs, or director(s) of the national security authority/ies), which are then required to investigate the matter and take the requisite action to bring the authority’s activities in line with the law; and/or
go to court for an order that any authority accessing personal data contrary to law cease any such access, as well as to claim for compensation for any losses incurred.

Under the DP Law, data subjects may request access to, and deletion or correction of, personal data held about them by law enforcement/national security authorities, as well as to ask for information about whether any processing is performed by those authorities. However, such rights can be restricted or denied under certain circumstances expressly provided by law (for example, if necessary to avoid the obstruction of an investigation or on national security grounds etc.).

SAFEGUARDS

I. Technical & Organisational Safeguards

Adobe’s relevant Technical Measures are as follows:

The Technical and Organisational Measures for Adobe Cloud Services here: www.adobe.com/go/CloudSvcsTOSM.
Adobe Certifications and Security White Papers.

Adobe also has comprehensive internal data protection policies which address broader data protection principles such as data minimisation.

II. Contractual Safeguards

The P-P SCCs have been incorporated into the relevant service providers’ data processing agreements with Adobe, including appropriate supplementary measures.

E. UNITED STATES

DESCRIPTION OF TRANSFERS

I. Summary

Customer personal data will be transferred to Adobe affiliates in the U.S as follows:

Business Contact Data is transferred because Adobe uses common systems (including for customer management purposes), and these systems are procured by Adobe Inc. Adobe affiliates in the U.S. use these systems to perform customer support functions on behalf of Adobe affiliates based in the EEA.
Personal data contained in Customer Content and Customer Data may be accessed when Adobe affiliates in the U.S. provide customer support on behalf of Adobe affiliates based in the EEA.
Customer Content and Customer Data is transferred when Adobe hosts products and services in the U.S. as listed on Adobe's List of Sub-Processors.

Please see our Transparency Report for details of requests from U.S. authorities seeking access to user data.

The ‘Schrems II’ decision focused on an assessment of a number of US national security laws and determined that certain aspects of these laws provide broad powers to access data, but that the SCCs may enable adequate protection, provided that data exporters take steps to assess risks and mitigate any such identified risks with appropriate safeguards. The updated SCCs published in the Annex to the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021 provide a basis for transfers that appropriately address the enumerated transfer risks. Furthermore, Adobe has reviewed the U.S. laws and practices that could result in access to personal data transferred to the U.S. as laid out in the recitals 90-200 of the European Commission’s decision of July 10, 2023 on the adequate level of protection of personal data under the EU-U.S. Data Privacy Framework and the materials referred to in that decision (specifically including Annexes VI and VII). Following Executive Order 14086 and the designation of the EU as a qualifying organization, the European Commission has determined that any interference in the public interest, in particular for criminal law enforcement and national security purposes, by U.S. public authorities with the fundamental rights of the individuals whose personal data are transferred will be limited to what is strictly necessary to achieve the legitimate objective in question, and that effective legal protection against such interference exists (see recital 203 of the Data Privacy Framework decision).

In light of the above, Adobe has concluded that the relevant laws that may permit government access to personal data processed by Adobe in the U.S. are subject to clear, publicly available legal rules, adhere to principles of necessity and proportionality, and contain significant safeguards, protections, and remedies for data subjects.

These laws are part of an established system of rule of law based upon a constitutional framework of checks and balances and recognizes fundamental privacy rights. However, acknowledging the ‘Schrems II’ decision ,the Data Privacy Framework and to address any residual risks, Adobe has implemented various contractual, organizational, and technical safeguards and measures – including, among other things, robust policies for vetting and challenging government requests, and various encryption protocols.

II. Personal Data Affected

The personal data transferred to the U.S. is contained in the following data categories:

Business Contact Data (user related)

Name, contact details, organisational name and contact details, credentials received from social networking sites.
Information processed to deliver services (e.g., IP address, device and browser type, account ID information) or about a user’s interaction with Adobe online.
Details of the marketing promotions which have been sent to, or viewed by, the recipient and how the recipient interacted with these.
For users who are individuals: date of birth, details of services supplied and eligibility for discounted services, billing, and payment information.

Customer Content as defined in the Adobe General Terms and Terms of Use:

Personal details and contact information including name, address, email address, title, position, contact information, social profile information, IP address, unique user IDs (such as cookie IDs) and marketing profiles.
Documents and Content: Documents, images, and content uploaded to the Adobe Cloud services in electronic form which may contain any type of personal data.

Customer Data as defined in the General Terms (enterprise customers only).

LEGAL ASSESSMENT

I. General Approach to the Rule of Law and Respect for Human Rights

The U.S. Constitution and its amendments provide broad privacy and civil rights protections and establishes the basis for a strong rule of law with separate branches of government: the legislative, the executive and an independent judiciary. Privacy rights are enshrined in various constitutional amendments, including: the First Amendment, which among other things, protects the right to free speech and peaceful assembly and protects privacy against certain forms of governmental intrusion; the Fourth Amendment, which protects against unreasonable searches and seizures by the government; and the Fifth Amendment, which provides the right to due process of law and the right not to be compelled to incriminate oneself. As over 100 years of constitutional jurisprudence make clear, the protection of privacy rights is fundamental to U.S. law, and governmental interference with those rights must be strongly restricted. The U.S. Congress has also passed many sectoral laws that protect privacy rights and the other fundamental freedoms, some of which, noted below, specifically impose limitations on government interference with or access to personal data.

The U.S. federal system of government further enables the states to go above and beyond the protections for fundamental privacy at the federal level. Numerous states explicitly recognize the right to privacy in their state constitutions and several states have enacted comprehensive data protection laws designed to protect the fundamental right to privacy. For example, California – a state that is home to a large number of U.S. providers (including Adobe) – has enacted a sweeping data protection law that contains many similarities to the GDPR.

Additionally, U.S. courts have recognized certain fundamental common-law privacy rights which are enforceable against private persons and entities.

II. National Data Protection Law and Independent Supervisory Authority

The U.S. does not have a general, federal data protection law. However, as noted above, some states such as California, Texas, Connecticut, Indiana, Iowa, Montana, Tennessee, Virginia Oregon, Utah and Colorado have introduced data privacy laws that offer similar protections to the GDPR.

The U.S. court system is the primary mechanism for oversight of privacy protections, including in the criminal and national security contexts.

III. Identification of the Laws that Allow Government Access to Personal Data

The mechanisms that may authorize the U.S. government to obtain data from service providers are found in the following laws:

The Electronic Communications Privacy Act, 1986 (“ECPA”), which is compromised of the Stored Communications Act, the Pen Register and Trap and Trace Act, and the Wiretap Act (18 U.S.C. § 2510 et seq.)
The Foreign Intelligence Surveillance Act (“FISA”) (50 U.S.C. § 1801 et seq.), and
Any authority applicable to national security letters (“NSLs”) (18 U.S.C. § 2709).

Although it was discussed in the CJEU’s Schrems II decision, Executive Order 12333 (“EO 12333”) does not authorize the U.S. government to compel companies like Adobe to produce any data or information. Instead, EO 12333 is a “general organizing directive” that places restrictions on the activities of U.S. intelligence agencies and spells out those agencies’ roles and responsibilities. See U.S. Dep’t of Commerce, U.S. Dep’t of Justice, and ODNI, Information on U.S. Privacy Safeguards Relevant to SCCs and Other EU Legal Bases for EU-U.S. Data Transfers after Schrems II (“Joint White Paper”), at 16 (Sept. 2020). Additionally, EO 12333 is primarily relevant for U.S. intelligence operations outside of the U.S., meaning that EO 12333 has virtually no practical importance for Adobe’s processing of data within the U.S. Adobe utilizes various encryption protocols to shield data against access while in transit, thereby minimizing any theoretical risks posed by EO 12333 to customer data in transit from Europe to the U.S.

IV. Proportionality Assessment of Rights to Access

The laws permitting the U.S. government to obtain data from providers like Adobe are justified by legitimate objectives, and serious forms of interference are generally restricted to serious objectives. Furthermore, the exact legal standards that the U.S. government must satisfy for each request effectively require necessity and proportionality.

Access in the criminal context pursuant to the authorities within ECPA must be justified by the need to investigate and counter crime and requires heightened levels of protection the more serious the interference with privacy. Surveillance under FISA is restricted to serious objectives and specific types of targets to avoid overbroad collection and requiring minimization. FISA requests—including requests issued under FISA Section 702—must generally be targeted to individual data subjects, meaning that surveillance should not occur in a massive or disproportionate fashion. Minimization rules applicable to FISA surveillance serve to further prevent disproportionate collection. In the ‘Schrems II’ decision, based on the record before it, the CJEU questioned whether the U.S. government’s powers under FISA Section 702 are sufficiently proportionate. On October 7, 2022 U.S. President Biden signed EO 14086 on the Enhancing of Safeguards for United States Signals Intelligence Activities which placed new requirements on the collection and handling of personal data by U.S. intelligence agencies regardless of the subject's nationality. Specifically, it requires that signals intelligence activities must be "necessary" and "proportionate" to advance a validated intelligence priority and that such activities must be undertaken in pursuit of one of twelve enumerated national security and intelligence objectives. EO 14086 also expands the oversight of signals intelligence programs by U.S. government agencies, including a new Civil Liberties Protection Officer (“CLPO”), appointed by the Director of National Intelligence, who must conduct an assessment prior to any new intelligence-gathering operations. Furthermore, bulk collection may only be authorised where the intelligence cannot be reasonably obtained through targeted collection and intelligence agencies must maintain documentation regarding their collection of personal data through signals intelligence and update their policies and procedures to ensure effective oversight of the new safeguards. Finally, EO 14086 also creates a redress mechanism for individuals from "qualifying states" who claim their personal data has been collected unlawfully through signals intelligence programs. Individuals can lodge a complaint to the CLPO, which has the power to investigate complaints and render binding decisions against intelligence agencies. Individuals can also appeal decisions by the CLPO before the Data Protection Review Court, which has been established through regulations issued by the U.S. Attorney General.

Based on Adobe’s in-depth assessment of the laws and practices applicable to the U.S. government’s use of FISA Section 702 (which includes extensive information declassified following the issuance of the ‘Schrems II’ decision as well as the range of safeguards and limitations applied under EO 14086), we have concluded that the government’s use of FISA Section 702 is subject to numerous controls that are adhered to in practice, including various encryption protocols, proportionality controls and avenues for rectification and review.

V. Independent Oversight and Prior Approval

Most of the powers above require prior approval by a court, with highly limited exceptions:

Under ECPA, requests for basic subscriber information (“BSI”) – a highly limited subset of less-sensitive personal data – can proceed without prior judicial authorization (but are subject to ongoing supervision and ex-post challenge before independent courts).
NSL requests can be authorized by a high-ranking official within the FBI. However, the types of personal data available through an NSL request are extremely limited and not particularly sensitive.
Individual targeting decisions under FISA Section 702 can proceed without prior court authorization. However, the government’s use of FISA Section 702 is subject to robust review and oversight, which includes concurrent Department of Justice review for each individual targeting decision in accordance with a certification approved by the independent Foreign Intelligence Surveillance Court (“FISC”), and subsequent oversight and monitoring by the FISC, various congressional authorities, and by an independent expert body, the Privacy and Civil Liberties Oversight Board (“PCLOB”).

VI. Transparency

Typically, providers may notify individuals of requests for their personal data. However, there are exceptions where notice could lead to certain harms or to the effectiveness of an investigative tool.

For the most serious interferences, applicable law and guidance limit the extent to which notice may be withheld and, absent exceptional circumstances, places limits on the duration of the prohibition on user notice. Additionally, providers are able to publish robust statistical reports on the requests that they receive, as Adobe does on an annual basis. If an ECPA request seeks the data of a business customer, Adobe also seeks to redirect the request to the business customer.

As is common for countries’ intelligence-gathering authorities globally, FISA requests are classified for national security reasons and ordinarily cannot be disclosed unless they are declassified – on the basis of national security. However, if government intends to use any information collected under FISA authority in a criminal proceeding, it must notify the data subject and give the data subject an opportunity to bring a challenge. To the extent they receive such requests, providers are also legally entitled to publish regular aggregate reporting on their receipt of FISA Orders, Directives, or NSLs. The government also releases robust reporting on its use of surveillance authorities, which includes aggregate metrics for each type of legal process. As noted in Adobe’s most recent Transparency Report, to date Adobe has not received any form of national-security request, including any requests issued pursuant to FISA.

VII. Individual Remedies for Breach of Laws

Data subjects have a variety of remedies available to them via the courts if their personal data is improperly collected, including through civil actions seeking monetary damages. Providers, data subjects and civil society organizations also frequently challenge the government’s use of various authorities to access data and information, both in the criminal context and national security context. Providers frequently engage in "representational redress" on behalf of their users and can challenge both criminal and national security requests that do not comply with constitutional or statutory protections. In the criminal context, many of these provider-initiated challenges are a matter of public record. Because FISA requests are generally classified, challenges to these requests are less frequently a matter of public record. However, publicly available court decisions – including declassified opinions of the FISC – demonstrate that data subjects, providers, and others do challenge the government’s use of FISA authorities.

Based on the record before it, the CJEU held in its ‘Schrems II’ decision that data subjects lack an adequate remedy in connection with data accessed by the U.S. government under FISA 702. However as per the new safeguards of EO14086, there is now a redress mechanism for individuals from "qualifying states" who claim their personal data has been collected unlawfully through signals intelligence programs. These individuals may complain directly to the CLPO, who can then investigate and render binding decisions against intelligence agencies before the Data Protection Review Court. Individuals will be represented before the court by special advocates and the decisions of the court will be final and binding.

VIII. Data Subjects Right to Access, Erase or Correct Personal Data

The relevant U.S. laws discussed above do not contain express, free-standing rights permitting data subjects to access, erase, or correct personal data held about them by law enforcement or national security agencies. However, if the U.S. government seeks to introduce such data in proceedings against the data subject, the data subject will have an opportunity to review the data, contest its accuracy, and challenge its collection. Furthermore, providers like Adobe are entitled to notify data subjects of most government requests (with narrow exceptions for circumstances such as where the request is classified for reasons of national security). Consequently, barring exceptional circumstances, data subjects have the means to know what data is being processed and why.

SAFEGUARDS

I. Technical & Organisational Safeguards

Adobe’s relevant Technical Measures are as follows:

The Technical and Organisational Measures for Adobe Cloud Services here: www.adobe.com/go/CloudSvcsTOSM.
Adobe Certifications and Security White Papers.

Adobe’s Organisational Measures include those set out in its Transparency Reportand Law Enforcement Guidelines,which describe Adobe’s approach to access requests from government and law enforcement and its user notice policies. Unless legally prohibited from doing so, Adobe commits to redirect requests pertaining to business customers and gives notice (enclosing a redacted copy of the request) whenever a government agency seeks access to their information.

Adobe also has comprehensive internal data protection policies which address broader data protection principles such as data minimisation.

II. Contractual Safeguards

Adobe relies on the SCCs for transferring European personal data out of Europe. Given the history of overturned transfer mechanisms between the EU and the US, together with the understanding that the protections under EO 14086 exist regardless of the transfer mechanism deployed, while Adobe is certified under the Data Privacy Framework, it will continue to manage the residual risk of US transfers of personal data using supplementary measures described above in combination with the Standard Contractual Clauses. Adobe’s view is that the data transfer itself concerns data that has a lower risk profile, and this is borne out in the relatively low number of requests Adobe has received historically. Accordingly, Adobe seeks to manage the remaining risk by reference to the measures cited above, which consist of a combination of technical, organisational and contractual measures, seek to ensure that the data transferred to the US benefits from a level of protection that is adequate in relation to that of the EU.

F. SINGAPORE

DESCRIPTION OF TRANSFERS

I. Summary

Personal data in the form of Business Contact Data/Customer Content Data will be processed by two third-party suppliers with operations in Singapore in order to provide Customers with requested services.

Singapore’s legal framework is fundamentally different when measured against EU standards (see below), as there are more limited independent oversights, less transparency and redress for data subjects, and no bilateral arrangement specifically protecting foreign data subjects. On a purely legal framework analysis, Singapore does not provide essentially equivalent protection to that required under GDPR or UK GDPR.

However, the practical risk picture for the specific scenario of a software company passing limited prompt data through a Singapore-based sub-processor is materially more benign. The realistic likelihood of government access to routine commercial data of this kind is low, Singapore has strong pragmatic incentives to maintain its reputation as a trustworthy data processing location, and there are no known patterns of practice suggesting authorities routinely access this type of commercial data.

Adobe has concluded that the relevant laws in Singapore that may permit some level government access to personal data offer a lower level of protection than that guaranteed within the EU and cause risks for the exported data that cannot be fully accounted for by the SCCs, particularly with regard to the lack of a fully independent oversight mechanism and of remedies available for affected individuals. However, the risk of the personal data in question being accessed by public authorities in Singapore is theoretical rather that practical and indeed Adobe has never received a request from Singaporean authorities seeking access to end user data. To further address the residual risks, Adobe has implemented additional technical, organizational, and contractual supplementary measures to ensure that the data accessed from Singapore benefits from a level of protection that is adequate in relation to that of the EU.

The conclusion for this transfer impact assessment is therefore that while the legal framework alone is insufficient, the combination of low practical risk, supplementary technical measures such as end-to-end encryption, and robust contractual provisions including appropriate sub-processor obligations, brings the transfer to an acceptable risk level.

II. Personal Data Affected

The personal data transferred to Singapore is as follows:

Business Contact Data:

Contact details provided in the customer support request handled by the data importer and other details accessed by the data importer for verification and support purposes including:

Name, contact details, organizational name and contact details.
Details of customer support provided (e.g. details of raising and responding to customer support cases).

Customer Content Data:

The configuration includes potentially sending contact information and identifiers (User GUID) and electronic network activity and device information (including activity logs, ECID, image encoding/graphics data, search terms, time zone, usage analytics, and user activity/navigation including user prompts). It also includes user account information and user-generated content (such as documents, images, recordings or other files user chooses to upload), Gen AI prompts/feedback and information provided to customer support. No sensitive of special category personal data is permitted (as per Adobe’s General Terms of Use) and individuals cannot be identified from any pictures uploaded.

LEGAL ASSESSMENT

I. General Approach to the Rule of Law and Human Rights

Singapore consistently ranks highly on rule of law indices in terms of contract enforcement and commercial legal certainty, low corruption (it is considered one of the least corrupt countries in the world), judicial independence in commercial and civil matters; and predictability and consistency of law. Singapore performs very well on rights that relate to economic wellbeing, with high standards of healthcare, housing, and education combined with very low poverty rates and strong worker safety in formal employment.

Overall Singapore is broadly seen as a place where the rule of law functions reliably for business and civil matters, but where political and civil freedoms can potentially face constraints when weighed against stability, order, and technocratic governance. The government in Singapore takes the position that civil liberties must be balanced against social order and economic development. While not authoritarian in the way of other one-party states, it is also not considered an entirely liberal democracy, instead occupying a distinct middle ground that its leadership actively defends as a legitimate and superior model for its context.

II. International Data Protection Commitments, National Data Protection Law and Independent Supervisory Authority

Singapore is not a signatory to any binding international data protection treaty in the way that EU member states are bound by GDPR, but it has made several meaningful international commitments and engagements in this space. At the regional level, Singapore has been an active participant in the APEC Privacy Framework, which establishes baseline principles for data protection across Asia-Pacific economies. Building on this, Singapore is a participant in the APEC Cross-Border Privacy Rules (CBPR) system, a voluntary certification mechanism that allows businesses to demonstrate compliance with agreed data protection standards when transferring personal data across borders within the APEC region. This is arguably Singapore's most concrete international data protection commitment, as it creates a degree of mutual recognition with other participating economies including the United States, Japan, South Korea, and others.

Singapore is also a founding member of the Global CBPR forum. The Global CBPR system is a voluntary, accountability-based certification framework designed to facilitate secure and privacy-respecting cross border data transfers while ensuring robust data protection standards. Building on the foundation of the Asia-Pacific Economic Cooperation (APEC) CBPR system, the Global CBPR extends its reach beyond APEC economies, creating an international standard for data privacy that transcends regional boundaries. Global CBPR Forum currently includes nine member economies: Australia, Canada, Japan, Mexico, the Philippines, the Republic of Korea, Singapore, Chinese Taipei, and the United States.

Singapore has also engaged with the Global Privacy Assembly, an international forum of data protection and privacy authorities, which allows its Personal Data Protection Commission (PDPC) to participate in shaping global norms and best practices, though this body produces soft law rather than binding obligations. Bilaterally, Singapore has signed a number of Digital Economy Agreements (DEAs) with countries including Australia, the United Kingdom, South Korea, and Chile. These agreements include provisions on data flows and data protection standards, representing a growing network of commitments to maintain baseline protections when facilitating cross-border digital trade. The UK-Singapore DEA is particularly notable given the UK's post-Brexit effort to build its own network of data adequacy-style arrangements.

Singapore has not received a formal adequacy decision from the European Commission, meaning it is not deemed to automatically provide equivalent protection to the GDPR. Transfers of personal data from the EU to Singapore therefore require additional safeguards such as standard contractual clauses. However, Singapore's data protection framework under the Personal Data Protection Act (PDPA) has been progressively strengthened, and there is ongoing dialogue about closer alignment with international standards.

Domestically, Singapore's PDPA has been amended over time in ways that reflect international influences, including stronger breach notification requirements and increased accountability obligations, suggesting a trajectory toward greater compatibility with frameworks like GDPR even in the absence of formal binding commitments.

Overall, Singapore's international posture on data protection is best characterised as pragmatic and trade-oriented, prioritising the facilitation of data flows that support its role as a regional business hub, rather than adopting the rights-centred, prescriptive approach of the European model.

III. Identification of the Laws that Allow Government Access to Personal Data

Singapore has several legal frameworks that permit government authorities to access personal data, often with limited oversight or judicial authorisation requirements. The Internal Security Act allows for surveillance and data access powers in the name of national security. The Criminal Procedure Code grants law enforcement powers to compel the production of data and documents in the course of investigations. The Computer Misuse Act contains provisions that can be used to access electronic data in certain circumstances. The Telecommunications Act and related regulations give authorities powers to require telcos and service providers to disclose communications data. More recently, the Foreign Interference (Countermeasures) Act (FICA), passed in 2021, grants powers to access data and compel disclosure from individuals and platforms in the context of suspected foreign interference.

Beyond these, sector-specific legislation in areas such as banking, healthcare, and tax also contains provisions allowing regulatory authorities to access personal data held by organisations in those sectors, often without the knowledge of the data subject.

The oversight mechanisms governing these access powers are relatively limited compared to European standards. There is no independent judicial warrant requirement for many forms of data access and so executive authorisation is often sufficient. Parliamentary oversight exists but is constrained by the dominant position of the ruling government party. There is no dedicated independent surveillance oversight body equivalent to those found in some European jurisdictions. The PDPA itself explicitly carves out exemptions for public agencies, meaning government data collection and access falls largely outside the consumer-facing data protection framework. However there are separate rules under the Government Instruction Manual 8 (“IM8”) and the Public Sector (Governance) Act apply to public agencies. These provide comparable standards of data protection as the PDPA. However, contra the PDPA which is enforced by the PDPC, there is no independent external regulator for the PSGA and IM8. IM8 is also not publicly available (i.e. classified) making it difficult to independently verify standards.

In practice, Singapore's government is widely understood to make use of its data access powers, though the extent is difficult to quantify given the lack of transparency reporting. Unlike US technology companies which publish transparency reports detailing government data requests, there is no equivalent culture of disclosure in Singapore. The government has historically defended its surveillance and data access activities as necessary for maintaining public order and national security, consistent with its broader governance philosophy.

Singapore's legislation is generally well-drafted, published, and accessible through official government portals such as the Singapore Statutes Online database, which is freely available and reasonably easy to navigate. In that sense, the laws are accessible and Singapore scores well compared to many jurisdictions on the formal availability of its legal texts.

IV. Proportionality Assessment of Rights to Access

The legal framework in Singapore provides some grounds and limitations for the exercise of government data access powers, but these do not extend as far as what would generally be considered necessary and proportionate when compared to European standards.

Most of Singapore's data access legislation does articulate some purpose limitations and threshold requirements. The Internal Security Act ties its powers to national security and public order. The Criminal Procedure Code requires that data access be connected to a criminal investigation. FICA requires a basis of suspected foreign interference. In that narrow sense, the laws are not entirely open-ended, there is at least a stated purpose for which the powers may be exercised, and they are not formally available for any arbitrary reason.

However, the necessity and proportionality analysis is fundamentally different than the European counterparts. First, the threshold concepts used in Singapore's legislation are broadly defined and largely self-assessed by the executive. Terms like “national security” and “public order” can be interpreted widely and there is limited means of external checks on whether a particular exercise of power genuinely meets the stated threshold. Second, there is no comprehensive independent judicial authorisation process for many of these powers. In European human rights law, prior independent authorisation is generally considered a core component of proportionality in the context of surveillance and data access. Third, there are limited data minimisation requirements attached to the exercise of these powers, authorities are not clearly obliged to seek only the minimum data necessary for the stated purpose, which is a key element of proportionality as understood in international human rights frameworks.

A dimension of necessity and proportionality in international human rights law, and from the European perspective, is the availability of effective remedies for individuals whose data has been unlawfully accessed. In Singapore this can be constrained. Judicial review of executive action exists but is considered narrow in scope. The ISA explicitly limits the role of the courts in reviewing detention and associated decisions. Individuals are generally not notified when their data has been accessed, making it difficult to seek redress in such scenarios. There is no independent data protection authority with jurisdiction over public agencies that could investigate complaints about government data access.

The benchmark most relevant for EU transfer assessments is the standard articulated in instruments such as the International Covenant on Civil and Political Rights, the UN High Commissioner for Human Rights reports on privacy in the digital age, and as interpreted through the Court of Justice of the European Union's decisions in cases like Schrems II. That standard requires that interference with privacy be based in law, pursue a legitimate aim, be necessary in a democratic society, be proportionate to that aim, and be subject to independent oversight and effective remedy. Singapore's framework certainly satisfies the first two but is not as strong on the remaining three.

However, it is worth noting that Singapore does not view this particular framework as the appropriate benchmark. The government's position is that its legal system provides adequate safeguards within its own constitutional and governance tradition, and that the European standard reflects a particular political philosophy that is not universally binding. This is a coherent position on its own terms, however given the context of this document, this assessment is required to apply European standards regardless of the destination country's view of those standards.

V. Limitations to Right of Access

In the legislation there are some structural safeguards. The Singapore Constitution contains a right to personal liberty, and judicial review of executive action is available in principle. The PDPA's accountability and governance requirements apply to private sector organisations handling data, and sector-specific regulators in areas like banking impose additional controls on how data is managed. There is also an ombudsman-type complaints mechanism through the PDPC, though as noted its jurisdiction does not extend to public agencies.

VI. Independent Oversight and Prior Approval

Singapore does not have an independent oversight body with specific jurisdiction over government surveillance or data access powers. The PDPC, which is Singapore's data protection authority, has no jurisdiction over public agencies, which places it entirely outside the most relevant area of concern. There is currently no dedicated parliamentary intelligence committee with genuine investigative powers comparable to those found in the UK, Germany, or other European jurisdictions. Parliamentary oversight more broadly is structurally limited by the PAP's dominant majority, which constrains the adversarial scrutiny that effective legislative oversight requires.

Judicial oversight is available instead through the courts, but as noted previously Singapore's judiciary has previously shown deference to the executive in national security matters, and many of the relevant powers either do not require prior judicial authorisation or place explicit limits on the court's supervisory role.

There is also no equivalent to the Investigatory Powers Tribunal in the UK, the G10 Commission in Germany, or the oversight frameworks established in other Council of Europe member states, which provide at least some independent scrutiny of surveillance activities even if imperfect. Nor is there an independent inspector general or similar office with a mandate to audit the exercise of data access powers and report publicly on findings

VII. Transparency

There is no legal requirement on government agencies to publish statistics on the number or nature of data access requests made to private organisations. Unlike the United States, where despite its own significant surveillance concerns many technology companies (including Adobe) at least publish transparency reports disclosing aggregate request volumes, Singapore has no equivalent culture or legal framework compelling such disclosure. Therefore Information on how often authorities use access powers does not appear to be publicly available.

VIII. Individual Remedies for Breach of Laws

Judicial review exists in Singapore but is narrow in scope, deferential to the executive in national security contexts, and can be difficult for individuals who may be unaware their data has been accessed in the first place. The absence of notification requirements means the right to seek remedy exists only where the individual has discovered their data has been accessed.

The PDPC offers a complaints mechanism for private sector data handling but has no jurisdiction over public agencies. There is no specialist tribunal with jurisdiction over surveillance or government data access, and no equivalent of the redress mechanisms that have been a specific requirement in EU adequacy and transfer framework negotiations with other countries. Legal proceedings under the ISA are explicitly curtailed. Cost, complexity, and the opacity of the framework create further practical barriers

SAFEGUARDS

IX. Technical & Organizational Safeguards

Adobe’s relevant Technical Measures are as follows:

· The Technical and Organizational Measures for Adobe Cloud Services here: https://www.adobe.com/go/CloudSvcsTOSM.

· Adobe Certificationsand Security White Papers.

Adobe also has comprehensive internal data protection policies which address broader data protection principles such as data minimisation.

X. Contractual Safeguards

Adobe relies on the SCCs for transferring European personal data out of Europe – the modules selected by Adobe include provisions designed to address ‘Schrems II’ concerns (i.e. Clauses 14 and 15 of the EU SCCs).

G. Indonesia

DESCRIPTION OF TRANSFERS

I. Summary

Personal data in the form of Business Contact Data/Customer Content Data will be processed by a third-party supplier with operations in Indonesia in order to provide Customers with requested services.

Indonesia’s legal framework is fundamentally different when measured against EU standards (see below), as there are more limited independent oversights, less transparency and redress for data subjects, and no bilateral arrangement specifically protecting foreign data subjects. Additionally Indonesia does not have an EU adequacy decision and is not a recognised qualifying state under any bilateral arrangement equivalent to the EU-US Data Privacy Framework. Therefore on a purely legal framework analysis, Indonesia does not provide essentially equivalent protection to that required under GDPR or UK GDPR.

However, the practical risk picture for the specific scenario of a software company passing limited prompt data through a sub-processor with some technical operations in Indonesia carries minimal material risk. The realistic likelihood of government access to routine commercial data of this kind is low, Indonesia has strong pragmatic incentives to maintain its reputation as a trustworthy data processing location, and there are no known patterns of practice suggesting authorities routinely access the type of commercial prompt data in scope for Adobe’s use.

Adobe has concluded that the relevant laws in Indonesia may permit some level government access to personal data offer a lower level of protection than that guaranteed within the EU and cause risks for the exported data that cannot be fully accounted for by the SCCs, particularly with regard to the lack of a fully independent oversight mechanism and of remedies available for affected individuals. However, the risk of the personal data in question being accessed by public authorities in Indonesia is theoretical rather that practical and indeed Adobe has never received a request from Indonesian authorities seeking access to end user data. To further address the residual risks, Adobe has implemented additional technical, organizational, and contractual supplementary measures to ensure that the data accessed from Indonesia benefits from a level of protection that is adequate in relation to that of the EU.

The conclusion for this transfer impact assessment is therefore that while the legal framework alone is insufficient, the combination of low practical risk or likelihood of government access, transient processing architecture, supplementary technical measures such as end-to-end encryption, and robust contractual provisions including appropriate sub-processor obligations, brings the transfer to an acceptable risk level.

II. Personal Data Affected

The personal data transferred to Indonesia is as follows:

Business Contact Data:

Contact details provided in the customer support request handled by the data importer and other details accessed by the data importer for verification and support purposes including:

Name, contact details, organizational name and contact details.
Details of customer support provided (e.g. details of raising and responding to customer support cases).

Customer Content Data:

LEGAL ASSESSMENT

I. General Approach to the Rule of Law and Human Rights

Indonesia is the world's third-largest democracy by population, a constitutional republic operating under a presidential system with a directly elected president, a bicameral legislature, and a Constitutional Court that has demonstrated meaningful independence in a number of significant decisions. The legal system is a civil law system with Dutch colonial heritage, supplemented by customary law (adat) and religious law (syariah) in certain contexts and regions. Indonesia's rule of law profile is improving but uneven. On commercial legal certainty and contract enforcement, Indonesia performs at a middle-tier level, the World Bank's Doing Business indicators historically placed Indonesia in the mid-range on contract enforcement, reflecting a functional but slow and sometimes inconsistently applied court system. Indonesia ranks in the lower half of Transparency International's Corruption Perceptions Index, though the Corruption Eradication Commission (KPK) has been an active and at times effective anti-corruption body, albeit one that has faced legislative amendments in 2019 that weakened its independence. Judicial independence is recognised in principle but still subject to concerns, particularly at lower court levels. The Constitutional Court has been a more robust institution and has issued significant decisions on civil liberties. The Supreme Court's track record is more mixed.

On civil liberties and human rights the picture presents meaningful concerns for TIA purposes:

Freedom of expression is constrained through broad provisions of the Electronic Information and Transactions Law (ITE Law — Undang-Undang Informasi dan Transaksi Elektronik), which has been criticised by civil society organisations and international human rights bodies including the UN Special Rapporteur on Freedom of Expression.. The 2022 revision to the ITE Law made some improvements but left problematic provisions largely intact.
Freedom of assembly and association is constitutionally protected but subject to restrictions in practice, particularly for political movements, labour organisations, and communities in conflict-affected regions. Human rights organisations including Amnesty International and Human Rights Watch have documented restrictions on civil society in Papua and West Papua.
Indonesia's security apparatus has broad powers. The National Intelligence Agency (Badan Intelijen Negara — BIN) operates with limited independent oversight. The National Police (POLRI) and the Military Intelligence (Badan Intelijen Strategis — BAIS) have overlapping mandates with limited external accountability. The Law on State Intelligence (Law No. 17/2011) grants BIN broad data collection and surveillance powers.

The overall picture is therefore of a functioning democracy with improving but still fragile rule of law institutions, meaningful civil liberties concerns, broad and loosely constrained intelligence and security powers, and limited independent oversight of government data access activities.

II. International Data Protection Commitments, National Data Protection Law and Independent Supervisory Authority

Indonesia is not a signatory to any binding international data protection treaty equivalent to the GDPR framework and has not received an EU adequacy decision. Indonesia participates in the APEC Privacy Framework and has been involved in discussions around the APEC Cross-Border Privacy Rules system, though its participation is less mature than Singapore's. Indonesia is not a member of the Global CBPR Forum. Domestically, Indonesia enacted its first comprehensive personal data protection law — Law No. 27/2022 on Personal Data Protection (Undang-Undang Perlindungan Data Pribadi — UU PDP) — on 17 October 2022, with a two-year transition period ending 17 October 2024. The UU PDP is Indonesia's first dedicated data protection statute and represents a significant legislative development, drawing substantially on the GDPR framework in its structure and principles. The UU PDP covers: lawful bases for processing including consent, contract, legal obligation, vital interests, public interest, and legitimate interests; data subject rights including access, correction, deletion, withdrawal of consent, and objection to automated processing; obligations on personal data controllers and processors including data breach notification; and cross-border transfer requirements. The supervisory authority is the Ministry of Communication and Information Technology (Kemenkominfo), though a dedicated independent data protection authority as envisaged under the UU PDP had not yet been established as a fully independent body as of mid-2026, oversight remains primarily within the ministry structure. The UU PDP represents a meaningful step toward international alignment but several gaps relative to GDPR remain, including the absence of a fully independent supervisory authority, limited enforcement track record given its recent entry into force, and uncertainty around implementation of several provisions. The law is also more permissive on government processing, Article 15 of the UU PDP exempts processing for national security, defence, public security, and law enforcement purposes from many of the law's protections.

Indonesia's international posture on data protection is best characterised as developing and reform-oriented, with the UU PDP representing a genuine commitment to higher standards that has not yet been fully operationalised.

III. Identification of the Laws that Allow Government Access to Personal Data

Indonesia has multiple legal frameworks permitting government authorities to access personal data, with varying levels of oversight and judicial authorisation requirements.

The Law on State Intelligence (Law No. 17/2011) grants BIN broad powers to collect, process, and use intelligence including personal data. The law's oversight mechanisms are limited, BIN reports primarily to the President and is subject to parliamentary oversight through the House of Representatives Commission I, but independent external review is constrained. The law does not require judicial authorisation for intelligence collection activities.

The Law on Telecommunications (Law No. 36/1999) and the Government Regulation on Lawful Interception (Government Regulation No. 53/2021 — PP SIPS) govern interception of electronic communications. PP SIPS requires a court order for interception in criminal investigations but provides a broader national security pathway that does not require prior judicial authorisation in all cases. The regulation has been criticised for its broad scope and limited safeguards.

The Electronic Information and Transactions Law (ITE Law — Law No. 11/2008 as amended by Law No. 19/2016 and Law No. 1/2024) grants authorities broad powers to access electronic data in the context of criminal investigations under the ITE Law, including access to data held by electronic system operators. Electronic system operators are required to provide access to electronic systems and data at the request of the competent authority for supervision, law enforcement, national security, and defence purposes.

As mentioned, the UU PDP Article 15 creates a broad carve-out for national security, defence, public security, and law enforcement purposes, meaning that many of the law's protections for individuals do not apply to government data access in these contexts.

Indonesian legislation is generally published and accessible through official government portals including the State Secretariat's legal database. However, the full scope of government data access powers is distributed across multiple legislative instruments and implementing regulations, making comprehensive assessment difficult. The intelligence framework in particular is broadly drafted with limited published guidance on how it is applied in practice.

IV. Proportionality Assessment of Rights to Access

Indonesia's legislation articulates some purpose limitations for the exercise of data access powers. The PP SIPS interception regulation requires court authorisation for criminal investigation interception. The ITE Law ties its data access provisions to investigation of ITE-related offences.

However the necessity and proportionality analysis reveals significant gaps measured against EU standards. BIN's intelligence collection powers under Law No. 17/2011 are broadly framed with limited external threshold assessment. The national security carve-out in the UU PDP Article 15 removes many protective provisions precisely in the context where their application is most important for TIA purposes. There is no comprehensive independent judicial authorisation requirement for all forms of intelligence access, executive authorisation through BIN and the President is often the operative mechanism. The ITE Law's broad defamation and hate speech provisions have been applied extensively against ordinary online expression, suggesting that broadly drafted digital law powers are used actively in contexts that go well beyond serious security threats. This pattern of application is relevant to the proportionality assessment. The benchmark applicable for EU transfer assessments, that interference with privacy be based in law, pursue a legitimate aim, be necessary in a democratic society, be proportionate to that aim, and be subject to independent oversight and effective remedy, is partially satisfied. Indonesia satisfies the first two criteria more clearly than the remaining three.

V. Limitations to Right of Access

Some of Indonesia's data access legislation is framed in terms that imply targeting. PP SIPS interception orders must be directed at specific identified subjects of a criminal investigation. ITE Law data access provisions are framed around investigation of specific offences.

However there are meaningful reasons to question whether access is genuinely targeted in practice. BIN's intelligence collection powers under Law No. 17/2011 are not subject to the same targeting requirements, intelligence collection can be authorised more broadly for national security purposes without the individual targeting constraints that apply in criminal investigations. The national security carve-out in UU PDP Article 15 creates potential for broad access that is not subject to the data minimisation and proportionality constraints that apply to commercial processing. Indonesia does not have a transparency reporting framework. There is no legal obligation on government agencies or private companies to publish statistics on data access requests. The absence of transparency reporting makes it impossible to empirically verify how targeted access powers are in practice.

As with Singapore (assessed above) and Malaysia (assessed below), the inability to verify targeting is itself a material factor. Where the legal framework permits broad access and transparency is absent, the precautionary logic of GDPR requires that uncertainty be resolved in favour of the data subject.

VI. Oversight and Prior Approval

Indonesia's Constitution recognises a right to privacy under Article 28G, and judicial review of executive action is available through the administrative courts (PTUN) and the Constitutional Court. The UU PDP creates a framework of rights and obligations for commercial processing that represents meaningful progress.

However the UU PDP's Article 15 carve-out for national security, defence, public security, and law enforcement removes important protective provisions in the context relevant to this TIA. The supervisory authority under the UU PDP is not yet fully independent, oversight sits within the ministry structure, limiting its ability to independently scrutinise government data access activities. BIN's operations are subject to parliamentary oversight but this is structurally limited by the executive-dominant character of Indonesian politics. As of the date of this TIA Constitutional privacy protections have not yet generated a robust body of jurisprudence constraining intelligence and law enforcement data access. Secrecy obligations in the intelligence framework limit public understanding of the scope of actual access.

VII. Transparency

There is no legal requirement on Indonesian government agencies to publish statistics on data access requests made to private organisations. Indonesia does not have the transparency reporting culture of the United States, and Indonesian technology companies and infrastructure providers do not publish aggregate government request statistics. Electronic system operators under the ITE Law and PP SIPS are subject to confidentiality obligations regarding lawful interception requests. The UU PDP does not create a transparency reporting framework for government access. The absence of published transparency data means it is not possible to form a reliable evidence-based picture of how government data access powers are exercised in practice. This opacity is itself a material factor for TIA purposes.

VIII. Individual Remedies for Breach of Laws

Administrative court review (PTUN) exists for challenges to government administrative decisions and Constitutional Court review is available for constitutional challenges. These mechanisms provide some avenue for remedy but are slow, costly, and have not generated a substantial track record of successful challenges to intelligence or security data access. The UU PDP creates complaint mechanisms with the supervisory authority for commercial data handling but these do not extend to government data access in national security contexts given the Article 15 carve-out. There is no specialist tribunal with jurisdiction over surveillance or intelligence data access. Data subjects are not notified when their data is accessed by authorities, making the right to seek remedy practically inaccessible in most cases. There is no bilateral redress mechanism between Indonesia and the EU equivalent to those negotiated in EU adequacy or transfer framework arrangements. However the UU PDP creates data subject rights including access, correction, and deletion for commercial personal data processing. These rights have been enforceable since October 2024 and the supervisory authority is developing its enforcement capacity, though the track record of enforcement is limited given the law's recent entry into force.

These rights do not extend to personal data processed for national security, defence, public security, or law enforcement purposes given the UU PDP Article 15 carve-out. Data subjects have no statutory right to know what data is held about them in intelligence and security contexts, no right to correct inaccuracies, and no right to seek erasure. There is no notification requirement when data is accessed by authorities.

SAFEGUARDS

IX. Technical & Organizational Safeguards

Adobe’s relevant Technical Measures are as follows:

The Technical and Organizational Measures for Adobe Cloud Services here: https://www.adobe.com/go/CloudSvcsTOSM.
Adobe Certificationsand Security White Papers.

Adobe also has comprehensive internal data protection policies which address broader data protection principles such as data minimisation.

X. Contractual Safeguards

H. MALAYSIA

DESCRIPTION OF TRANSFERS

I. Summary

Personal data in the form of Business Contact Data/Customer Content Data will be processed by two third-party suppliers with operations in Malaysia in order to provide Customers with requested services.

Malaysia is a constitutional monarchy with a parliamentary democracy operating under a legal system derived from English common law. It presents a more complex rule of law profile than Singapore (assessed above) for TIA purposes, less commercially predictable and with more active concerns around civil liberties and government overreach than Singapore, though operating in a recognisably democratic framework.

Malaysia performs reasonably well on commercial legal certainty and contract enforcement, with an established court system and an active legal profession. The Malaysian Bar Council has historically been an active and independent voice on rule of law concerns. Corruption remains a concern, Malaysia ranks materially lower on Transparency International indices, though the post-2018 political transition brought anti-corruption efforts to greater prominence. Judicial independence in commercial matters is broadly respected, though there have been periodic concerns about executive influence over judicial appointments.

On civil liberties and political freedoms there remain risks. Malaysia's governance philosophy shares some characteristics with Singapore's in that the ruling establishment has historically prioritised social stability and economic development over liberal political freedoms, but without the consistent delivery of economic outcomes like the Singapore model. In practice:

Freedom of expression is constrained through the Sedition Act, Section 233 of the Communications and Multimedia Act (CMA), and the Printing Presses and Publications Act. Sedition cases increased sharply after 2020, targeting opposition politicians, student activists, journalists, and online commentators. Parallel use of Penal Code provisions and Section 233 of the CMA produced hundreds of enforcement actions.
Public assembly is regulated through a restrictive notification regime granting police broad dispersal authority, and assemblies linked to human rights and anti-corruption movements have been investigated or dispersed.
Media freedom is constrained by the Printing Presses and Publications Act, and digital expression faces expanding regulation through takedown orders, surveillance, and proposed identity verification requirements.
Preventive detention powers exist under the Security Offences (Special Measures) Act (SOSMA) and the Prevention of Crime Act, which allow detention without full judicial oversight.

These laws are not exceptional measures, they function as routine governance tools, as noted by the UN Special Rapporteur on Torture and Other Cruel, Inhuman or Degrading Treatment. Malaysia's political landscape is genuinely contested, with multiple parties competing and a history of governments being changed, which provides authentic democratic accountability. However political competition has also contributed to instability and has at times been associated with the weaponisation of legal tools against political opponents. The overall picture is of a functioning democracy with meaningful rule of law in commercial contexts and genuine but imperfectly constrained civil liberties concerns.

As a result, for a software company transferring limited customer data to a sub-processor in Malaysia, specifically transient AI inference prompt data, the realistic likelihood of Malaysian government authorities actively seeking access to that specific data is low.

Malaysia's security and law enforcement apparatus is primarily focused on national security threats, organised crime, political opposition activities, and matters of direct domestic relevance. Routine commercial data processed by a technology sub-processor, particularly prompt data that is transient, fragmented, and lacking obvious intelligence value, is unlikely to attract active interest from authorities.

Malaysia has ambitions to be a regional technology and data centre hub, with significant investment from major cloud providers in recent years. There is a pragmatic commercial incentive to maintain the trust of international businesses and not to exercise broad legal powers in ways that would undermine Malaysia's reputation as a viable data processing location.

There are no widely reported cases of Malaysian authorities seeking access to routine commercial data processed by technology sub-processors on behalf of foreign companies. The most significant examples of expansive data access in Malaysia relate to political surveillance and social media monitoring rather than commercial sub-processing infrastructure.

That said, several residual considerations are worth noting even where the practical likelihood is low. The legal powers are broadly framed. The confidentiality obligations attached to many access powers mean that neither the sub-processor nor the exporting organisation would be informed if access occurred. The proposed Cybercrimes Bill 2026 could materially expand surveillance infrastructure in ways that could affect the future risk profile beyond what the current legal framework alone suggests. And the absence of transparency reporting means there is no empirical basis for confidently quantifying the frequency of access to commercial data of this kind.

In conclusion while Malaysia presents a higher residual risk profile than a country like Singapore (assessed above) on the rule of law and oversight dimensions, the practical risk for transient commercial data is low, and the commercial incentive to maintain trust is present in both.

II. Personal Data Affected

The personal data transferred to Malaysia is as follows:

Business Contact Data:

Contact details provided in the customer support request handled by the data importer and other details accessed by the data importer for verification and support purposes including:

Name, contact details, organizational name and contact details.
Details of customer support provided (e.g. details of raising and responding to customer support cases).

Customer Content Data:

The configuration includes potentially sending contact information and identifiers (User GUID) and electronic network activity and device information (including activity logs, ECID, image encoding/graphics data, search terms, time zone, usage analytics, and user activity/navigation including user prompts). It also includes user account information and user-generated content (such as documents, images, recordings or other files user chooses to upload), Gen AI prompts/feedback and information provided to customer support. No sensitive of special category personal data is permitted (as per Adobe’s General Terms of Use) and individuals cannot be identified from any pictures uploaded.

LEGAL ASSESSMENT

I. General Approach to the Rule of Law and Human Rights

II. International Data Protection Commitments, National Data Protection Law and Independent Supervisory Authority

Malaysia is not a signatory to any binding international data protection treaty equivalent to the GDPR framework. Its international data protection commitments are primarily regional and trade-oriented. Malaysia participates in the APEC Privacy Framework and has been involved in APEC Cross-Border Privacy Rules (CBPR) discussions, though its participation is less mature than Singapore's. Malaysia is not a founding member of the Global CBPR Forum in the same capacity as Singapore. Malaysia has not received a formal adequacy decision from the European Commission and is not on any EU or UK adequacy list. Transfers of personal data from the EU or UK to Malaysia therefore require additional safeguards including SCCs.

Domestically, Malaysia has made significant recent progress. The Personal Data Protection (Amendment) Act 2024 introduced new requirements including appointment of a data protection officer, data breach notification, and right of data portability, and enhanced the requirements for cross-border personal data transfers. The amendments align the PDPA more closely with both international and regional data protection standards such as the GDPR, carrying similarities with regulatory efforts by other ASEAN member states including Thailand, Indonesia, and Vietnam. On 29 April 2025, Malaysia's Cross Border Personal Data Transfer Guidelines came into effect, requiring data controllers to conduct Transfer Impact Assessments and implement more robust safeguards for personal data transmitted overseas, bringing the country in line with global standards like the GDPR.

Malaysia's international posture on data protection is best characterised as progressively improving and trade-oriented, moving toward greater compatibility with international standards without having yet achieved the maturity of Singapore's framework or a formal bilateral arrangement with the EU.

III. Identification of the Laws that Allow Government Access to Personal Data

Malaysia has several legal frameworks permitting government authorities to access personal data, with varying levels of oversight and judicial authorisation requirements.

The Security Offences (Special Measures) Act 2012 (SOSMA) grants broad powers in national security contexts, including powers to detain and access communications data, with limited judicial oversight. The Prevention of Crime Act 1959 and the Dangerous Drugs (Special Preventive Measures) Act 1985 similarly provide preventive detention powers with restricted judicial review. The Criminal Procedure Code grants law enforcement powers to compel production of documents and data in the course of criminal investigations. The Communications and Multimedia Act 1998 contains provisions requiring service providers to disclose communications data to authorities. The Computer Crimes Act 1997 contains data access powers in the context of computer crime investigations.

Malaysia's Cybercrimes Bill 2026 has attracted significant criticism — Section 41(2) allows the Public Prosecutor to authorise any officer to install interception devices for the interception, retention, collection, and recording of communication or content data. The designation and subsequent demands would not be subject to external review or meaningful rights of appeal, creating a high potential for systemic surveillance capability rather than isolated interception. This law signals the direction of legislative travel on surveillance powers.

Malaysian legislation is generally published and accessible through official government portals. However, the full scope of government data access powers is distributed across multiple pieces of legislation rather than consolidated in a single framework, making comprehensive assessment difficult without significant legal expertise. National security powers in particular are broadly drafted with limited published guidance on practical application.

Unlike Singapore, Malaysia has no equivalent of a classified IM8 framework for public agency data handling, but similarly lacks a consolidated, accessible account of how government data access powers are exercised in practice. There is limited transparency reporting from either government agencies or private companies on the frequency or nature of government data access requests

IV. Proportionality Assessment of Rights to Access

Malaysia's legislation articulates some purpose limitations for the exercise of data access powers. SOSMA ties its powers to security offences. The Criminal Procedure Code frames production powers around active criminal investigations. These provide at least nominal purpose limitations rather than entirely open-ended access.

However the necessity and proportionality analysis reveals significant gaps when measured against EU standards. The threshold concepts used, national security, public order, security offences, are broadly defined and largely self-assessed by the executive. There is limited external checking of whether a particular exercise of power genuinely meets the stated threshold. There is no comprehensive independent judicial authorisation requirement for many access powers, executive or prosecutorial authorisation is often sufficient.

Sedition and CMA enforcement actions have been used extensively against political speech and online commentary, suggesting that broadly drafted powers are applied actively and not reserved for narrowly defined security threats. This pattern of broad application is relevant to the proportionality assessment even where the specific data at issue in this TIA, transient AI inference prompts, is unlikely to attract attention.

Data minimisation requirements are not clearly embedded in the exercise of access powers. Authorities are not explicitly obliged to seek only the minimum data necessary for the stated purpose, which is a core element of proportionality under international human rights standards and as interpreted by the CJEU in Schrems II and subsequent EDPB guidance.

The benchmark applicable for EU transfer assessments, that interference with privacy be based in law, pursue a legitimate aim, be necessary in a democratic society, be proportionate to that aim, and be subject to independent oversight and effective remedy, is partially but not fully satisfied. Malaysia, like Indonesia (assessed above), satisfies the first two criteria more clearly than the remaining three.

V. Limitations to Right of Access

Some of Malaysia's data access legislation is framed in terms that imply targeting and limitations being applied. Criminal Procedure Code production powers are framed around specific investigations. SOSMA powers are tied to security offences involving identified suspects or organisations.

However, SOSMA and related security legislation have historically been applied broadly and preventively. The Cybercrimes Bill 2026 surveillance powers described above (specifically the interception device provision) could create infrastructure for systemic rather than targeted surveillance, with no external authorisation requirement. Article 19 noted that this appears to create a high potential for systemic surveillance capability rather than isolated interception, with no meaningful rights of appeal against designation.

Malaysia is not part of the Five Eyes intelligence sharing arrangement. There are bilateral intelligence relationships with regional partners but these are less extensively documented than Singapore's. The implications of those relationships for data access are not fully transparent.

As with Singapore (assessed above), the near-complete absence of transparency reporting makes it impossible to empirically verify how targeted access powers are in practice. There is no legal obligation on government agencies or private companies to publish statistics on data access requests. The confidentiality obligations attached to many access powers prevent recipients from disclosing that requests have been received. For the purposes of this document this uncertainty itself is a relevant factor, where targeting cannot be verified and the legal framework permits broad access, it is difficult to conclude that the regime provides essentially equivalent protection to that required under EU law.

VI. Limitations to Right of Access

The Malaysian Constitution contains fundamental liberty protections including Article 5 (right to personal liberty) and Article 10 (freedom of speech and assembly), and judicial review of executive action is available in principle. The PDPA's accountability requirements apply to private sector organisations. The 2024 amendments have strengthened the PDPA framework materially.

However the PDPA explicitly applies primarily to commercial data users in the private sector, there is no equivalent public sector data protection framework that would apply to government data access activities. Unlike Singapore which has the classified IM8 framework providing at least some internal standards for public agencies, Malaysia's public sector data handling governance is less clearly documented.

Constitutional protections have been interpreted with significant deference to the executive in security contexts. The judiciary has historically been less robustly independent in public law matters than in commercial matters. Secrecy obligations attached to many access powers prevent recipients and the public from understanding the scope of what is occurring. Data subjects have no notification rights when their data is accessed by authorities.

The cumulative effect is that meaningful structural constraints on government data access beyond the formal legal text are limited, and the primary data protection framework does not extend to the most significant source of concern.

VII. Transparency

Malaysia does not have an independent oversight body with specific jurisdiction over government surveillance or data access powers. The Personal Data Protection Commissioner has been appointed to implement the PDPA's provisions but jurisdiction extends to private sector data controllers rather than government agencies. There is no dedicated parliamentary intelligence committee with genuine investigative powers comparable to those found in European jurisdictions.

Parliamentary oversight is structurally more meaningful than in Singapore given Malaysia's more genuinely contested political landscape, opposition parties hold seats and can scrutinise government, but is still limited in practice when it comes to national security matters where information is withheld on grounds of sensitivity.

Judicial oversight exists in theory but is constrained in national security contexts. SOSMA and related legislation limit the scope of judicial review of executive decisions made under them. There is no specialist tribunal with jurisdiction over surveillance or government data access, and no independent inspector general or equivalent body mandated to audit and publicly report on the exercise of data access powers.

VIII. Individual Remedies for Breach of Laws

Judicial review exists in principle but is narrow in scope and deferential to the executive in security contexts. The absence of notification requirements means the right to seek remedy is only available where an individual has independently discovered that their data has been accessed, which in practice appears to be rare.

The Personal Data Protection Commissioner offers a complaints mechanism for private sector data handling but has no jurisdiction over public agency data access. There is no specialist tribunal with jurisdiction over surveillance or government data access. SOSMA explicitly limits judicial review of certain executive decisions. Cost, complexity, and the opacity of the framework create further practical barriers.

There is no bilateral redress mechanism between Malaysia and the EU equivalent to those negotiated as part of EU adequacy or transfer framework arrangements with other countries.

The 2024 Amendment Act introduced data portability rights and strengthened data subject rights under the PDPA for private sector data handling. These rights are reasonably well implemented in that context following the 2025 amendments and the Commissioner enforces them with increasing regularity.

However these rights do not extend to public agencies, which are not subject to the PDPA in the same way. Where government data access is concerned, data subjects have no statutory right to know what data is held about them, no right to correct inaccuracies, and no right to seek erasure. There is no notification requirement when data is accessed by authorities, which as noted above renders most other rights practically meaningless since they cannot be exercised without knowledge that a problem exists.

SAFEGUARDS

IX. Technical & Organizational Safeguards

Adobe’s relevant Technical Measures are as follows:

The Technical and Organizational Measures for Adobe Cloud Services here: https://www.adobe.com/go/CloudSvcsTOSM.
Adobe Certificationsand Security White Papers.

Adobe also has comprehensive internal data protection policies which address broader data protection principles such as data minimisation.

X. Contractual Safeguards