Compliance With Singapore Privacy Obligations; Made Easier!

Compliance With Singapore Privacy Obligations; Made Easier!

The Personal Data Protection Act 2012 (PDPA) governs the collection, use, and disclosure of private personal data by organizations in Singapore. Through this legislation, companies are mandated to observe key obligations upon the general directive of the Personal Data Protection Commission (PDPC).

With the enactment of new regulations through its latest amendments, strict adherence with Singapore privacy obligations can be tricky especially with SMEs. Hence, we curated this article to give you tips in keeping up with your PDPA responsibilities and thus avoiding hefty penalties for noncompliance.

Also Read: A Review of PDPC Undertakings July 2021 Cases

1. Consent, Purpose Limitation and Notification Obligation

This obligation features a three-fold responsibility. Organizations are required by the PDPA to develop and implement policies and operation procedures that 1) notify their customers of the data collection, 2) notify them as to what extent the data is to be used, and 3) obtain their customer’s consent in providing such personal data.

To comply, your organization should:

• Come up with a privacy policy that is available to public, such as those posted on company premises and/or website
• Secure the customer’s consent through your terms and conditions
• Always give your customers the option to withdraw their consent on the collection of personal data

2. Access and Correction Obligation

The PDPA requires that the collected information is open for scrutiny and correction. This means that upon request, companies must provide customers with their personal data which may also be changed upon the latter’s perusal.

To comply, your organization should:

• Implement an SOP on catering customer’s request for updating, correcting, and deleting personal data
• Ensure compliance with the 30-day Rule- PDPA gives an organization 30 days to act on a customer’s request for access. However, this can be extended by additional 30 days if the delay is justified. Nevertheless, it is best to act on a customer’s request post-haste.

3. Accuracy Obligation

Organizations are expected to verify the veracity of collected personal data, especially if such is to be used in making decisions that would affect the general customer experience.

To comply, your organization should:

• Require your customers to attest the accuracy and completeness of provided personal data through verbal or written confirmation.
• Contact third party provider to take extra steps in verifying the accuracy of the data collected.

4. Protection Obligation

As one of the highlights of Singapore’s privacy obligations, organizations are expected to prevent any unauthorized access, collection, use, disclosure or disposal of stored customer data.

To comply, your organization should:

• Adapt a robust cybersecurity protocol by ensuring that your computer networks are 100% secured and your employees well-trained in handling threats.
• Exercise precautionary measures by marking confidential documents clearly and prominently; storing such in secured cabinet systems; and restricting employee access only to those who are qualified to handle such sensitive information.

5. Retention Limitation Obligation

The PDPA requires companies to dispose stored personal data once they have served their purpose.

To comply, your organization should:

• Implement an appropriate personal data protection policy which clearly outlines periodic review of stored private data.
• Practice proper cybersecurity hygiene by disposing personal data as soon as it is no longer useful. Some ways on how to go about this is by; 1) returning the documents to the customer, 2) destroying the documents, 3) “anonymising” the personal data

6. Transfer Limitation Obligation

This obligation is fairly straightforward as companies are not allowed to transfer data to any country outside of Singapore.

7. Openness Obligation

This obligation is different than the second obligation insofar as this mandates companies to develop and implement policies for complying with Singapore privacy obligations under the PDPA.

8. Do-Not-Call-Provisions

As one of the pillars of the PDPA, companies are required to check the DNC registry within 30 days of sending marketing material to a customer through a registered Singapore phone number.

The exemption to this rule is when the customer have already expressed their unambiguous consent to receive marketing messages through their Singapore phone number.

As we have always expressed in our PDPA-compliance articles, getting fully informed on your responsibilities is owning half the battle. When you know your Singapore privacy obligations inside and out, adherence to the rules becomes way easier. Verily, your chance of incurring a violation lessens and your customer’s private personal data are afforded with far greater security.

Hiring a DPO can help.

Aside from the fact that it is mandatory under the PDPA, an outsourced Data Protection Officer (DPO) oversees data protection responsibilities and ensures that organizations comply with the all the obligations under the Personal Data Protection Act (PDPA). Furthermore, every Organization’s DPO should be able to curb any instances of PDPA noncompliance as it is the officer responsible for maintaining the positive posture of an organization’s cybersecurity.

Also Read: Got A Notice of Data Breach? Don’t Panic!