Get to know your organisation’s obligations under the PDPA to safeguard personal data entrusted to you by your customers and employees.

IMDA PAW_Infographic Post_FA-v2

Download the full infographic here.

1. Accountability Obligation

Undertake measures to ensure that organisations meet their obligations under the PDPA such as making information about your data protection policies, practices and complaints process available upon request and designating a data protection officer (DPO) and making the business contact information available to the public

More about Accountability Obligation

2. Notification Obligation

Notify individuals of the purposes for which your organisation is intending to collect, use or disclose their personal data.

3. Consent Obligation

Only collect, use or disclose personal data for purposes which an individual has given his/her consent to.

Allow the individual to withdraw consent, with reasonable notice, and inform him/her of the likely consequences of withdrawal. Once consent is withdrawn, make sure that you cease to collect, use or disclose the individual’s personal data.

4. Purpose Limitation Obligation

Only collect, use or disclose personal data for the purposes that a reasonable person would consider appropriate under the given circumstances and for which the individual has given consent.

An organisation may not, as a condition of providing a product or service, require the individual to consent to the collection, use or disclosure of his or her personal data beyond what is reasonable to provide that product or service.

5. Accuracy Obligation

Make reasonable effort to ensure that the personal data collected is accurate and complete, especially if it is likely to be used to make a decision that affects the individual or to be disclosed to another organisation.

6. Protection Obligation

Reasonable security arrangements have to be made to protect the personal data in your organisation’s possession to prevent unauthorised access, collection, use, disclosure or similar risks.

7. Retention Limitation Obligation

Cease retention of personal data or dispose of it in a proper manner when it is no longer needed for any business or legal purpose.

8. Transfer Limitation Obligation

Transfer personal data to another country only according to the requirements prescribed under the regulations, to ensure that the standard of protection is comparable to the protection under the PDPA, unless exempted by the PDPC.

More about Transfer Limitation Obligation

9. Access and Correction Obligation

Upon request, organisations have to provide individuals with access to their personal data as well as information about how the data was used or disclosed within a year before the request.

Organisations are also required to correct any error or omission in an individual’s personal data as soon as practicable and send the corrected data to other organisations to which the personal data was disclosed (or to selected organisations that the individual has consented to), within a year before the correction is made.

10. Data Breach Notification Obligation

In the event of a data breach, organisations must take steps to assess if it is notifiable. If the data breach likely results in significant harm to individuals, and/or are of significant scale, organisations are required to notify the PDPC and the affected individuals as soon as practicable.

11. Data Portability Obligation*

At the request of the individual, organisations are required to transmit the individual’s data that is in the organisation’s possession or under its control, to another organisation in a commonly used machine-readable format.

Exceptions may apply to the obligations above. For more information, please refer to Advisory Guidelines on Key Concepts in the Personal Data Protection Act.

*This will take effect when the Regulations are issued.