DPP Topic 4 - PDPA

Question 1

Personal Data Protection Act (PDPA)

Answer 1

Singapore’s data privacy regulation that governs the collection, use, and disclosure of personal data

Question 2

Motivation for PDPA

Answer 2

Encourage business innovation while guaranteeing personal data protection and strengthen Singapore’s position as a trusted hub for businesses

Question 3

Extraterritorial effect of PDPA

Answer 3

Applicable to organizations collecting, using, or disclosing personal data in Singapore, regardless of the organization’s physical presence or where it was incorporated

Question 4

Penalties for non-compliance

Answer 4

Up to 10% of an organization’s annual turnover in Singapore or SGD 1 million, whichever is greater, as well as reputation damage

Question 5

Data Protection Obligations

Answer 5

11 obligations that organizations must comply with when undertaking activities relating to the collection, use, or disclosure of personal data

Question 6

1) Accountability

Answer 6

Organizations must take responsibility for the personal data under their possession or control, appoint a data protection officer, develop policies, and implement measures

Question 7

2) Notification (Collection)

Answer 7

Notify individuals of the purposes for which the organization is intending to collect, use, or disclose their personal data

Question 8

3) Consent (Collection)

Answer 8

Personal data may be collected, used, or disclosed only after consent has been given by the individual

Question 9

4) Purpose Limitation (Collection)

Answer 9

Personal data may be collected, used, or disclosed only for purposes that are reasonable to provide the organization’s product or service

Question 10

5) Accuracy (Care)

Answer 10

Organizations should ensure that the personal data collected is accurate and complete

Question 11

6) Protection (Care)

Answer 11

Organizations should put in place the required security measures to protect personal data and prevent unauthorized access

Question 12

7) Retention Limitation (Care)

Answer 12

Organizations should cease retention of personal data or dispose of it in a proper manner

Question 13

8) Transfer Limitation (Care)

Answer 13

Ensure that the standard of protection is comparable to the PDPA when transferring personal data to another country

Question 14

9) Access and Correction (Autonomy)

Answer 14

Individuals have the right to request access to their personal data and for correction of their personal data

Question 15

10) Data Breach Notification (Autonomy)

Answer 15

In the event of a data breach that likely results in significant harm to individuals or is of significant scale, the PDPC and the affected individuals need to be notified

Question 16

11) Data Portability Obligation

Answer 16

At the request of the individual, organizations are required to transfer the individual’s data to another environment