JOIN THE DPO COMMUNITY! The deadline to file your Data Protection Officer (DPO) information with the PDPC via ACRA BizFile+ (www.bizfile.gov.sg) is around the corner. If you have not done so, please act by 30 September 2024. Kindly note that it is mandatory for all organisations to appoint a DPO and make their business contact information public under the PDPA.
Get to know your organisation’s obligations under the PDPA to safeguard personal data entrusted to you by your customers and employees.
Undertake measures to ensure that organisations meet their obligations under the PDPA such as making information about your data protection policies, practices and complaints process available upon request and designating a data protection officer (DPO) and making the business contact information available to the public.
Notify individuals of the purposes for which your organisation is intending to collect, use or disclose their personal data.
Only collect, use or disclose personal data for purposes which an individual has given his/her consent to.
Allow the individual to withdraw consent, with reasonable notice, and inform him/her of the likely consequences of withdrawal. Once consent is withdrawn, make sure that you cease to collect, use or disclose the individual’s personal data.
Only collect, use or disclose personal data for the purposes that a reasonable person would consider appropriate under the given circumstances and for which the individual has given consent.
An organisation may not, as a condition of providing a product or service, require the individual to consent to the collection, use or disclosure of his or her personal data beyond what is reasonable to provide that product or service.
Make reasonable effort to ensure that the personal data collected is accurate and complete, especially if it is likely to be used to make a decision that affects the individual or to be disclosed to another organisation.
Reasonable security arrangements have to be made to protect the personal data in your organisation’s possession to prevent unauthorised access, collection, use, disclosure or similar risks.
Cease retention of personal data or dispose of it in a proper manner when it is no longer needed for any business or legal purpose.
Transfer personal data to another country only according to the requirements prescribed under the regulations, to ensure that the standard of protection is comparable to the protection under the PDPA, unless exempted by the PDPC.
Upon request, organisations have to provide individuals with access to their personal data as well as information about how the data was used or disclosed within a year before the request.
Organisations are also required to correct any error or omission in an individual’s personal data as soon as practicable and send the corrected data to other organisations to which the personal data was disclosed (or to selected organisations that the individual has consented to), within a year before the correction is made.
In the event of a data breach, organisations must take steps to assess if it is notifiable. If the data breach likely results in significant harm to individuals, and/or are of significant scale, organisations are required to notify the PDPC and the affected individuals as soon as practicable.
At the request of the individual, organisations are required to transmit the individual’s data that is in the organisation’s possession or under its control, to another organisation in a commonly used machine-readable format.
Exceptions may apply to the obligations above. For more information, please refer to Advisory Guidelines on Key Concepts in the Personal Data Protection Act.
*This will take effect when the Regulations are issued.
To offer you a better experience, this site uses cookies. Read more about cookies in our Privacy Statement.
