Final HAVE REACHED the following understanding on this ASEAN Framework on Personal Data Protection (hereinafter referred to as “Framework”): Objectives 1. This Framework serves to strengthen the protection of personal data in ASEAN and to facilitate cooperation among the Participants, with a view to contribute to the promotion and growth of regional and global trade and the flow of information. Effect of the Framework 2. This Framework serves only as a record of the Participants’ intentions and does not constitute or create, and is not intended to constitute or create, obligations under domestic or international law and will not give rise to any legal process and will not be deemed to constitute or create any legally binding or enforceable obligations, express or implied. Scope of the Framework 3. The Participants will endeavour to cooperate, promote and implement in their domestic laws and regulations the Principles of Personal Data Protection as set out in Paragraph 6 of this Framework (herein referred to as “Principles”) while continuing to ensure and facilitate the free flow of information among the ASEAN Member States. 4. This Framework will not apply to: (a) Measures adopted by a Participant to exempt any areas, persons or sectors from the application of the Principles; and (b) Matters relating to national sovereignty, national security, public safety, public policy and all government activities deemed suitable by a Participant to be exempted. 5. Recognising the importance of cooperation, two or more Participants may enter into separate agreements to further strengthen collaboration on personal data protection in furtherance of the objectives of this Framework where practicable. Page 2 of 6