By now, Singaporeans must already be aware that the Personal Data Protection Act of 2012 is Singapore’s legislative response to the pre-existing patchwork of laws. The latter includes common law, sector-specific legislation and various self-regulatory or co-regulatory codes.
It is to be noted that while the PDPA applies to all organisations in respect of the personal data they collect, use, and or disclose, the following categories of organisations are not bound by the PDPA:
Also Read: 6 Simple Guides on PDPA Clause For Agreements of Personal Data
The first 9 chapters of the written guidelines cover the introduction and overview as well as the important terms used in the PDPA. In these beginning chapters, we get a clear definition, among others, of how personal data is identified, what collective data is, and what happens to personal data of deceased individuals.
These chapters also touch on excluded organisations as mentioned earlier in this article.
This chapter of the advisory guidelines on key concepts in the PDPA delves into the overview of the data protection provisions. It spells out nine main obligations which organisations are enforced to comply with if they undertake activities relating to the collection, use or disclosure of personal data.
These nine main obligations are:
Chapter 11 deals with applicability to inbound data transfers. Under this provision, organisations carrying out activities involving personal data in Singapore must adhere to the country’s existing guidelines. Several examples are also fleshed out in this chapter to paint different scenarios of how the PDPA provisions will be applied.
In Chapter 12, we dive into the consent obligation, wherein it states that organisations are mandated to obtain consent from individuals before collecting, using, or disclosing their personal data.
Whereas there are guidelines on where and to whom the PDPA is applied, chapter 13 touches on the purpose limitation obligation. In essence, it states that an organisation may collect, use or disclose personal data about an individual only for purposes:
The 14th chapter of the advisory guidelines on key concepts in the PDPA talks about the duty of organisations to inform the individuals of the purposes for which their personal data will be collected, used and disclosed in order to get their consent.
The 15th and 16th chapters of the advisory guidelines on key concepts in the PDPA discuss the access and correction obligations as well as the accuracy obligation.
In a nutshell, individuals have the right to request for access to their personal data and for correction of their personal data that is in the possession or under the control of the organisation.
As for the accuracy obligation, the PDPA requires an organisation to make a fair effort to make sure that personal data collected is accurate and complete under certain provisions.
Chapter 17 of the advisory guidelines on key concepts in the PDPA walks us through the protection obligation, where it states that an organisation is required by the PDPA to make reasonable security arrangements to protect personal data in its possession. This is to ensure that they can prevent unauthorised access of data, as well as illegal collection, use, disclosure, copying, and modification of such data, among others.
In chapter 18, the retention limitation obligation is discussed, where it fleshes out when an organisation should cease to retain its documents containing personal data, or remove the means by which the personal data can be associated with specific individuals.
Under the provision discussed in chapter 19, an organisation must not transfer any personal data to a country or territory outside Singapore except in accordance with requirements defined under the PDPA.
Chapter 20 talks about the concept of accountability among organisations in the context of how it discharges its responsibility for the personal data it has collected.
The final chapters of the advisory guidelines on key concepts in the PDPA tackle other rights, obligations, and uses. It bookends the whole document by discussing other minor provisions not yet covered in the previous chapters.
Also Read: PDPA For Companies: Compliance Guide For Singapore Business
To reiterate, organisations must adhere to these advisory guidelines on key concepts in the PDPA. This is to make sure they do not violate the data privacy of anyone, and that they uphold their credibility as a responsible organisation.
Established in 2018, Privacy Ninja is a Singapore-based IT security company specialising in data protection and cybersecurity solutions for businesses. We offer services like vulnerability assessments, penetration testing, and outsourced Data Protection Officer support, helping organisations comply with regulations and safeguard their data.
Singapore
7 Temasek Boulevard,
#12-07, Suntec Tower One,
Singapore 038987
