INDIVIDUAL RIGHTS UNDER PDPA Flashcards
What are the access rights for individuals under the PDPA?
Individuals have the right to request access to their personal data held by an organization - subject to certain exceptions such as legal restrictions - security and safety concerns - unreasonable impact on others - ongoing investigations - frivolous or vexatious requests - third-party information - and specific regulations.
What are the correction rights for individuals under the PDPA?
Individuals can request corrections to their personal data if it is inaccurate or incomplete.
What are the notification obligations in Singapore?
Organizations must notify individuals of the purposes before the collection - use - or disclosure of their personal data
What are the access obligations in Singapore?
Upon request - organizations must provide individuals with their data in the possession or control of the organization and information about the ways in which the personal data has been or may have been used or disclosed during the past year.
What is the response period and fulfillment of requests for access and correction in Singapore?
Fulfillment should be as soon as reasonably possible and preferably within 30 days of the request. If fulfillment is not possible within 30 days - a response should be provided within this period to inform about the expected time of fulfillment. If valid - the personal data should be corrected as soon as reasonably possible and the corrected data sent to other organizations to which the personal data was disclosed within a year before the correction is made.
Can an access fee be charged in Singapore?
Organizations can charge an individual a reasonable fee for access to personal data about the individual.
What are the complaint rights of individuals in Singapore?
Individuals can submit a complaint to the PDPC. They can also take civil action against the organization.
What are the retention and deletion requirements under the PDPA?
Organizations must retain personal data only as long as it is necessary to fulfill the purposes for which it was collected or as required by law. Once the data is no longer needed - organizations must cease retention and ensure secure deletion or anonymization. Organizations must use appropriate methods to prevent unauthorized access or recovery of the data - such as physical destruction - secure erasure - or anonymization techniques. Individuals have no deletion right.
