Today, the Commission has issued one Decision and two Undertakings.

The Decision involved a case arising from a member of public’s request for CCTV footage from the organisation. The organisation was found in breach of the PDPA’s Accountability Obligation for failing to appoint a Data Protection Officer ("DPO"), and for not having policies and procedures in place to guide the handling of access requests or manage third-party access to CCTV systems. This underscores the need for organisations to implement context-specific data protection policies, ensure proper delegation to intermediaries, and designate a responsible DPO to oversee compliance of the PDPA.

In the Undertakings, two organisations implemented remediation plans to improve its compliance with the PDPA. The PDPC has accepted these undertakings having considered the number of affected individuals, the types of personal data involved and the impact of the Incident.

Access the Decisions here and Undertakings here.