Essential PDPA Compliance Guide for Singapore Businesses

What is the Personal Data Protection Act (PDPA)?

The Personal Data Protection Act 2012 (PDPA) governs the collection, use and disclosure of personal data. The PDPA was passed by Parliament in October 2012 and came into force in 4 stages between January 2013 and July 2014.

The PDPA recognises both:

• The right of individuals (natural persons, whether living or dead) to protect their personal data; and
• The need of organisations (all corporate bodies – e.g. companies – and unincorporated bodies, including those formed or resident outside of Singapore) to collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances (see below).

What is personal data?

Personal data means:

• Data about an individual who can be identified from that data itself; or
• Data about an individual who can be identified from that data and other information to which your business has or is likely to have access

Examples of personal data that can, on its own, identify an individual include:

• Biometric identifiers (face geometry or fingerprints)
• Name and NRIC number
• Photograph or video image of an individual
• Voice of an individual
• DNA profile

Note that the PDPA also protects, to a limited extent, the personal data of individuals who have been dead for 10 years or fewer. For such personal data, only the provisions relating to the disclosure and protection of personal data will apply.

What are the types of personal data the that PDPA does not apply to?

The PDPA does not apply to the following categories of personal data:

• Personal data that is contained in a record that has been in existence for at least 100 years; and
• Personal data about a deceased individual who has been dead for more than 10 years
• Business contact information, which is information not provided by an individual solely for personal purposes, and includes an individual’s:
  • Name;
  • Business title;
  • Business telephone number; and
  • Business address and email address

Who is Not Obliged to Comply with the PDPA?

The PDPA imposes obligations on organisations in respect of the collection, use and disclosure of personal data in Singapore.

The following persons, however, do not have to comply with these obligations:

1. Any individual acting in a personal or domestic capacity;
2. Any public agency; and
3. Any organisation in the course of acting on behalf of a public agency in relation to the collection, use and disclosure of the personal data

Employees acting in the course of their employment with an organisation will have to adhere to their organisation’s policies for ensuring the organisation’s compliance with the PDPA. However, they themselves cannot be held personally liable for actions resulting in their organisation breaching the PDPA.

Additionally, organisations that are data intermediaries are partially excluded from these obligations.

The PDPA defines “data intermediary” as an organisation that processes personal data on behalf of another organisation. However, this definition does not include employees of the organisation (for which the data is being processed).

What are Your Business’ Obligations Under the PDPA?

The 10 main obligations under the PDPA are:

1. Consent Obligation

Your business can collect, use and/or disclose only the personal data of individuals who have consented to such collection, use and/or disclosure. Read more about the PDPA consent obligation in our other article.

2. Purpose Limitation Obligation

Your business can collect, use and/or disclose only the personal data of individuals for the purpose(s) for which consent have been given by these individuals.

3. Notification Obligation

Your business must inform individuals of the purpose(s) for which their personal data is being collected, used and/or disclosed.

4. Access and Correction Obligation

Your business is obliged to provide information to individuals, upon request and as soon as reasonably possible, on:

• What personal data of theirs is in your business’s possession or under its control; and
• How such personal data has been used or disclosed within 1 year before the date of the request

Your business must also correct errors or omissions in the personal data that is in its possession upon request, unless it is reasonable to not make the correction.

5. Accuracy Obligation

Your business must make a reasonable effort to ensure that the personal data collected by the business is accurate and complete, if the personal data is likely to be:

• Used by your business to make a decision that affects the individual to whom the personal data relates; or
• Disclosed by your business to another organisation

6. Protection Obligation

Your business must put in place reasonable security measures to protect the personal data in its possession or control, including the storage medium or devices on which such personal data is stored.

This is to prevent risks such as the unauthorised access, collection, use and/or disclosure of such data.

7. Retention Limitation Obligation

Your business should retain the personal data for only as long as is necessary for business or legal purposes.

8. Transfer Limitation Obligation

If your business is transferring the personal data overseas, such as storing the data in the cloud, ensure that the transfer meets the PDPA’s data protection requirements.

This is to ensure that the data being transferred is offered a comparable level of data protection as is provided by the PDPA.

9. Data Breach Notification Obligation

If your business has suffered a data breach that has caused (or is likely to cause) significant harm to affected individuals, or that has affected at least 500 individuals, then it generally must inform the Personal Data Protection Commission (PDPC) and affected individuals of the breach.

10. Accountability Obligation

Your business must implement the necessary policies and procedures to fulfil its PDPA obligations. It must make information about such policies and procedures publicly available.

PDPA Obligations Applied in Practice

To what extent can your business collect individuals’ personal data?

Pursuant to the Purpose Limitation Obligation (see above), your business may collect, use or disclose personal data about an individual:

• Only for purposes that a reasonable person would consider appropriate in the circumstances; and
• Your business has informed the individual of these purposes (where applicable under the Notification Obligation (see above)).

What is considered “appropriate in the circumstances”?

The particular circumstances need to be taken into account in determining whether the purpose of such collection, use or disclosure of personal data is reasonable.

For example, a purpose that is illegal or would harm the individual concerned is unlikely to be considered appropriate by a reasonable person.

Ensuring compliance with PDPA obligations

If your business regularly collects personal data, it is important to keep track of:

• What personal data is being collected
  • For compliance with the Protection Obligation
  • Being aware of the types of personal data being collected will allow you to have a better picture of the type of protective measures needed and evaluate if the purposes for which such data is being collected are best served by the data collection.

• For what purposes the personal data is being collected
  • For compliance with the Purpose Limitation Obligation and the Retention Limitation Obligation

• Who is collecting the personal data
  • For compliance with the Consent Obligation and Notification Obligation
  • Only authorised personnel who have received appropriate training in PDPA compliance should be involved in the collection process

• Where the personal data is stored
  • For compliance with the Protection Obligation

• To whom the personal data is disclosed
  • For compliance with the Access and Correction Obligation and Protection Obligation
  • While your business has to provide access to the personal data of an individual who requests for it, you should verify the identity of the individual. For example, by requesting for appropriate identification documents before providing such access. This would in turn prevent inadvertent leaks of personal data.

1. Implementing data protection policies

In order for your business to be in compliance with the Protection Obligation, it is critical to implement personal data protection policies and communicate such policies to your employees.

For example, your business could implement physical and technical data protection measures.

Physical measures include providing personal data access only to authorised personnel and ensuring that physical records (such as printed documents containing employees’ NRIC numbers and home addresses) are held in a secured location. For example, a locked filing cabinet.

Technical measures range from installing anti-virus software on computer systems to maintaining a strong password for electronic files containing personal data.

2. Utilising tools to assess your business’ compliance with the PDPA

The PDPA Assessment Toolkit available on the PDPC website may be helpful in identifying the areas in which your business is not PDPA compliant.

It provides a guided questionnaire on your business’ personal data protection and policies. It can therefore serve as a handy checklist of your business’ compliance with the PDPA obligations.

3. Appointing a Data Protection Officer (DPO)

It is also compulsory under the PDPA for your business to appoint one or more Data Protection Officer(s) (DPO) to supervise your business’ collection, usage and disclosure of personal data. The DPO is accordingly responsible for ensuring that your business complies with the PDPA.

Your DPO is also required to review and update your business’ PDPA policies and processes in line with the latest regulatory developments.

This is to ensure that your business remains PDPA compliant in light of changes to the relevant data protection rules.

Finally, your business’ DPO will serve as a point of contact for individuals to get in touch with your business for PDPA-related matters.

Read our other article for more information on appointing a Data Protection Officer.

Consequences of Non-Compliance with the PDPA

Your business is accountable for its PDPA compliance in various ways.

For example, individuals may request for access to their personal data held by your business (see the Access and Correction Obligation above). They may also submit a complaint to the PDPC which will investigate your business’ conduct and compliance with the PDPA.

If it is found that your business is not PDPA-compliant, the PDPC may:

• Impose a financial penalty of 10% of the organisation’s annual turnover in Singapore for organisations with annual local turnover exceeding S$10 million, or up to S$1 million, whichever is higher.
• Direct your business to stop collecting, using or disclosing personal data in contravention of the PDPA
• Direct your business to destroy personal data collected in contravention of the PDPA

In April 2016, the Business Times reported that 11 companies, including Challenger Technologies and K Box Entertainment Group (K Box), had been fined for breaching data protection obligations under the PDPA.

K Box, in particular, was given a financial penalty of $50,000 for failing to implement adequate security measures to protect the personal data of its members.

What Should You Do If You Collect, Use or Disclose Individuals’ Personal Data Throughout the Course of Your Business?

• If your business wants to store personal data in the cloud, you should take appropriate steps to ensure that the transfer of data to the cloud complies with the PDPA’s data protection laws.
• If your business issues newsletters through email, you should ensure that the creation and sending of your newsletter as well as the management of your subscriber list complies with the PDPA and other applicable laws.
• Should your business be involved in telemarketing, you should ensure that the relevant regulations, including those relating to the Do Not Call (DNC) Registry are complied with The DNC regime established under the PDPA, prohibits organisations from sending marketing messages to Singapore telephone numbers registered with the DNC Registry.
• If your business maintains physical or electronic records of personal data, these records have to be disposed of, using appropriate methods, as stipulated in the PDPA.
• Businesses are also not allowed to make copies of individuals’ NRICs, or collect, use or disclose NRIC numbers, unless this is required by law or required to verify an individual’s identity to a “high degree of fidelity”.

—

To prevent thefts and leaks of personal data, and monetary penalties as a result, it is important to have a clear understanding of the business’ PDPA obligations.

If you have any questions or concerns regarding PDPA compliance, consider getting in touch with one of our data protection lawyers.