Summary: Your Organisation’s 10 Main PDPA Obligations

Last updated on March 26, 2021

Your organisation is required to abide by the Personal Data Protection Act (PDPA) when using, collecting or disclosing personal data.

The 10 main personal data obligations under the PDPA are:

Here is a summary of each of them.

Your organisation may collect, use and/or disclose only the personal data of individuals who have consented to such collection, use and/or disclosure.

These individuals must also be given the option to withdraw their consent, subject to them giving reasonable notice. Upon the withdrawal of consent, your organisation must cease collecting, using and/or disclosing the personal data of these individuals.

Read more about the PDPA’s Consent Obligation in our other article.

2. Purpose Limitation Obligation

Your organisation may collect, use and/or disclose only the personal data of individuals for the purpose(s) for which consent have been given by these individuals.

These individuals should also not be required to consent to the collection, use and/or disclosure of their personal data beyond what is reasonable for the organisation to provide a particular product or service.

3. Notification Obligation

Your organisation should inform individuals of the purpose(s) for which their personal data is being collected, used and/or disclosed.

4. Access and Correction Obligation

Your organisation is obliged to provide information to individuals, upon request and as soon as reasonably possible, on:

What personal data of theirs is in your organisation’s possession or under its control; and
How such personal data has been used or disclosed within 1 year of the request.

Also, should an individual request that the organisation rectify any error or omission in his or her personal data, your organisation must accede to the request as soon as practicable.

5. Accuracy Obligation

Your organisation should ensure that the personal data collected by the organisation is accurate and complete.

6. Protection Obligation

Your organisation should put in place the required security measures to protect the personal data in its possession or control, including the storage media or devices on which such data is stored. This is to prevent any unauthorised access, collection, use and/or disclosure of such data.

Examples of when the protection obligation applies would be when your organisation is processing and sending personal data, or disposing of documents containing personal data.

7. Retention Limitation Obligation

Your organisation should retain the personal data for only as long as is necessary for business or legal purposes.

8. Transfer Limitation Obligation

If your organisation is transferring the personal data overseas, such as storing the data in the cloud, ensure that the country to which the data is being transferred offers a comparable level of data protection as is provided by the PDPA.

9. Data Breach Notification Obligation

If your organisation has suffered a data breach that has caused (or is likely to cause) significant harm to affected individuals, or that has affected at least 500 individuals, then it generally must inform the Personal Data Protection Commission (PDPC) and affected individuals of the breach.

10. Accountability Obligation

Your organisation should be open to sharing information about its data protection practices, policies and complaints processes upon request.

For example, your organisation’s privacy policy can state that individuals who wish to know more the organisation’s data protection policies can get in touch with its data protection officer, and also provide means of contacting that officer.

If you require legal advice on your business’ legal obligations under the PDPA, feel free to get in touch with one of our data protection lawyers.