Accuracy Obligation: What every organization should know

What every organization should know about the accuracy obligation

Accuracy is defined as the quality or state of being accurate or exact in and of itself. According to Section 23 of the PDPA, every Organization must make a reasonable effort to ensure that personal data collected by or on behalf of the Organization is accurate and complete if the personal data is: 

a) likely to be used by the Organization to make a decision that affects the individual to whom the personal data relates; or 

b) likely to be disclosed by the Organization to another organization.

The Accuracy Obligation’s purpose is to ensure that when personal data may be used to make a decision that affects the individual, the data is fairly accurate and complete in order to ensure that the decision is made, taking into account all relevant aspects of accurate personal data.

It is the goal of the Accuracy Obligation to make sure that when someone’s personal data is used to make a decision that affects them, the data is reasonably correct and complete. This way, the decision is made taking into account all of the relevant parts of accurate personal data.

To ensure that personal data is accurate and complete, an organization must make a reasonable effort to ensure that:

• a) the personal data it collects is accurately recorded (whether directly from the individual or through another organization);
• b) that personal data it collects includes all relevant components (to ensure that it is complete); and
• c) that it has taken the appropriate (reasonable) steps in the circumstances to ensure the accuracy and completeness of personal data.

Also Read: Guarding against common types of data breaches in Singapore

Requirement of reasonable effort under Accuracy Obligation

Organizations are required to make a reasonable effort to ensure the correctness and completeness of personal data under the Accuracy Obligation. As a result, the amount of work required by an organization varies according to the specific conditions. When establishing what constitutes a reasonable effort, an organization should consider the following:

a) the nature of the data and its significance to the individual concerned (e.g., whether the data relates to an important aspect of the individual’s life, such as his health); 

b) the purpose for which the data is collected, used, or disclosed; 

c) the data’s reliability (e.g., whether it was obtained from a reputable source or through a reputable means); 

d) the data’s currency (that is, whether the data is recent or was first collected, and 

e) the ramifications for the affected individual if the personal data is erroneous or incomplete.

Ensuring accuracy when personal data is provided directly by the individual

Organizations may presume that personal data provided directly by the individual concerned is accurate in most circumstances. When in doubt, organizations can consider requiring the individual to make a verbal or written declaration that the personal data provided is accurate and complete.

In addition, where the currency of the personal data is important, the Organization should take steps to verify that the personal data provided by the individual is up to date (for example, by requesting a more updated copy of the personal data before making a decision that will significantly impact the individual). 

How a DPO can help organizations

Of course, when Organizations fail to observe the accuracy obligation under the PDPC, a financial penalty can be imposed by the PDPC. To ensure that this never happens, a DPO can help.

A Data Protection Officer (DPO) oversees data protection responsibilities and ensures that organizations comply with the Personal Data Protection Act (PDPA). Furthermore, every Organization’s DPO should be able to curb any instances of cyber threats and instances of data breaches as it is the officer responsible for maintaining the positive posture of an organization’s cybersecurity. 

For instance, at Privacy Ninja, we randomly conduct simulated email phishing to clients to see if there are any vulnerabilities present that a bad actor can exploit and patch them to ensure that the client’s data will never leak. 

DPOs complement the efforts of Organizations in making sure that the personal data collected and used is accurate. This is because when there is an instance that the obligation has been breached, DPOs ensure that a protocol for dealing with it has been established and can be employed.

As a consumer who provides my very own sensitive information to each Organization I encounter or have a transaction with, I would feel safe if an organization would take the extra mile to ensure that my data is correct and concise as it affects me whenever a decision is made.

Also Read: The Singapore financial services and markets bill: Everything you need to know