Personal Data Protection Act 2010

Question 1

What is “Personal Data”?

Answer 1

It is any personal information in respect of commercial transactions. The data relates directly or indirectly to a data subject, usually includes sensitive personal data (religion, political views, physical and mental health). It also includes expressions of opinion about the data subject.

Question 2

When and why was PDPA created?

Answer 2

November 2013, it is to regulate the processing of personal data in commercial transactions.

Question 3

What are the seven principles of PDPA 2010?

Answer 3

GENERAL 
NOTICE AND CHOICE
DISCLOSURE 
SECURITY
RETENTION
DATA INTEGRITY
ACCESS

Question 4

Explain the principle of “General”.

Answer 4

Personal data shall be processed if:

• consent
• it is necessary or directly related
• adequate, not excessive

Sensitive data shall be processed if:

• given explicit consent
• it’s necessary
• info made public

Question 5

Explain the principle of “Notice and Choice”.

Answer 5

Data subjects should be informed by written notice:
1. data is being processed

2. purpose of collection
3. the source
4. of their rights to:
   - correct the data
   - contact the data for inquiries and complaint
   - informed of third parties to whom the data user discloses or may disclose
   - limit the choices and means

Whether it is obligatory or voluntary for the data subject to supply the personal data.
NOTICE shall be given soonest possible:

1. At the time first asked by the data used to provide his personal data
2. first collects the personal data
3. Before data user uses the personal data or discloses it to a 3rd party
4. given in the national and English

Question 6

Explain the principle of “Disclosure”.

Answer 6

No PERSONAL DATA shall be disclosed without the consent of the data subject:

1. for any other purpose other than the purpose it was collected
2. to any other party

Question 7

Explain the principle of “Security”.

Answer 7

A-DATA USER needs to take practical steps to protect the personal data from any:
LOSS, MISUSE, MODIFICATION, UNAUTHORISED/ACCIDENTAL DISCLOSURE, ALTERATION/DESTRUCTION

Must consider the following:

1. Nature of the data
2. Harm from misconduct
3. Place and location of stored data
4. Security measures to ensure reliability and integrity
5. Methods to secure transfer of personal data

Question 8

Explain the principle of “Retention”.

Answer 8

1. It shall not be kept any longer than necessary for the fulfilment of the purpose
2. If no longer required, necessary steps must be taken to ensure permanent deletion of data

Question 9

Explain the principle of “Data integrity”.

Answer 9

Data user shall take relationship steps to ensure that the personal data is:
ACCURATE
COMPLETE
NOT MISLEADING
KEPT UP TO DATE BY HAVING REGARD TO THE PURPOSE OF THE DATA

Question 10

Explain the principle of “Access”.

Answer 10

A-DATA SUBJECT shall be given their rights and access to:

1. personal data
2. ability to correct if: Inaccurate, incomplete, misleading, not updated