Privacy Ninja

Compliance With Singapore Privacy Obligations; Made Easier!

Compliance With Singapore Privacy Obligations; Made Easier!

Strict adherence with Singapore privacy obligations can be tricky especially with SMEs; here are few tips to make it easier
Strict adherence with Singapore privacy obligations can be tricky especially with SMEs; here are few tips to make it easier

The Personal Data Protection Act 2012 (PDPA) governs the collection, use, and disclosure of private personal data by organizations in Singapore. Through this legislation, companies are mandated to observe key obligations upon the general directive of the Personal Data Protection Commission (PDPC).

With the enactment of new regulations through its latest amendments, strict adherence with Singapore privacy obligations can be tricky especially with SMEs. Hence, we curated this article to give you tips in keeping up with your PDPA responsibilities and thus avoiding hefty penalties for noncompliance.

Also Read: A Review of PDPC Undertakings July 2021 Cases

1. Consent, Purpose Limitation and Notification Obligation

This obligation features a three-fold responsibility. Organizations are required by the PDPA to develop and implement policies and operation procedures that 1) notify their customers of the data collection, 2) notify them as to what extent the data is to be used, and 3) obtain their customer’s consent in providing such personal data.

To comply, your organization should:

  • Come up with a privacy policy that is available to public, such as those posted on company premises and/or website
  • Secure the customer’s consent through your terms and conditions
  • Always give your customers the option to withdraw their consent on the collection of personal data

2. Access and Correction Obligation

The PDPA requires that the collected information is open for scrutiny and correction. This means that upon request, companies must provide customers with their personal data which may also be changed upon the latter’s perusal.

To comply, your organization should:

  • Implement an SOP on catering customer’s request for updating, correcting, and deleting personal data
  • Ensure compliance with the 30-day Rule- PDPA gives an organization 30 days to act on a customer’s request for access. However, this can be extended by additional 30 days if the delay is justified. Nevertheless, it is best to act on a customer’s request post-haste.

3. Accuracy Obligation

Organizations are expected to verify the veracity of collected personal data, especially if such is to be used in making decisions that would affect the general customer experience.

To comply, your organization should:

  • Require your customers to attest the accuracy and completeness of provided personal data through verbal or written confirmation.
  • Contact third party provider to take extra steps in verifying the accuracy of the data collected.
Getting fully informed on your PDPA responsibilities is owning half the battle
Getting fully informed on your PDPA responsibilities is owning half the battle

4. Protection Obligation

As one of the highlights of Singapore’s privacy obligations, organizations are expected to prevent any unauthorized access, collection, use, disclosure or disposal of stored customer data.

To comply, your organization should:

  • Adapt a robust cybersecurity protocol by ensuring that your computer networks are 100% secured and your employees well-trained in handling threats.
  • Exercise precautionary measures by marking confidential documents clearly and prominently; storing such in secured cabinet systems; and restricting employee access only to those who are qualified to handle such sensitive information.

5. Retention Limitation Obligation

The PDPA requires companies to dispose stored personal data once they have served their purpose.

To comply, your organization should:

  • Implement an appropriate personal data protection policy which clearly outlines periodic review of stored private data.
  • Practice proper cybersecurity hygiene by disposing personal data as soon as it is no longer useful. Some ways on how to go about this is by; 1) returning the documents to the customer, 2) destroying the documents, 3) “anonymising” the personal data

6. Transfer Limitation Obligation

This obligation is fairly straightforward as companies are not allowed to transfer data to any country outside of Singapore.

7. Openness Obligation

This obligation is different than the second obligation insofar as this mandates companies to develop and implement policies for complying with Singapore privacy obligations under the PDPA.

8. Do-Not-Call-Provisions

As one of the pillars of the PDPA, companies are required to check the DNC registry within 30 days of sending marketing material to a customer through a registered Singapore phone number.

The exemption to this rule is when the customer have already expressed their unambiguous consent to receive marketing messages through their Singapore phone number.

As we have always expressed in our PDPA-compliance articles, getting fully informed on your responsibilities is owning half the battle. When you know your Singapore privacy obligations inside and out, adherence to the rules becomes way easier. Verily, your chance of incurring a violation lessens and your customer’s private personal data are afforded with far greater security.

Also Read: Got A Notice of Data Breach? Don’t Panic!

Privacy Ninja provides GUARANTEED quality and results for the following CORE SERVICES:

DPO-As-A-Service (Outsourced DPO Subscription)
Vulnerability Assessment & Penetration Testing (VAPT)
PDPA Obligations for Organizational Compliance (SkillsFuture Credit Eligible)

OTHER SERVICES:

PDPA Compliance Audit
Dig
ital Transformation Consultancy
Data Protection Trustmarks Certification Readiness Consultancy

PDPA Data Protection Software
Smart Contract Audit

LIKE & SUBSCRIBE:
Facebook
LinkedIn
Twitter
YouTube
Podcast

0 Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

KEEP IN TOUCH

Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection

REPORTING DATA BREACH TO PDPC?

We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.
×

Powered by WhatsApp Chat

× How can we help you?