1. Is it mandatory to register my organisation’s DPO via BizFile+?

Under the PDPA, it is mandatory for organisations to appoint a DPO and make the DPO's business contact information publicly accessible. While registering your organisation's DPO is voluntary, doing so would offer exclusive benefits, including:

• Access to free workshops and resources to support DPOs in safe data use
• Updates on the latest PDPA developments and best practices
• Insights into key data trends

Registering your DPO with PDPC enhances your organisation's ability to stay informed and compliant.

2. Must all organisations appoint a DPO?

All organisations, including sole proprietorships, are required to designate at least one person, a DPO, to be responsible for ensuring that the organisation complies with the PDPA. Organisations are also required to ensure that at least one DPO's business contact information is made available to the public. The business contact information may be a general telephone or email address of the organisation.

3. Who should I appoint as the DPO for my organisation?

The DPO may be an individual whose scope of work solely relates to data protection or an individual in the organisation who takes on this role as one of his multiple responsibilities.

A DPO should ideally be:

• a member of the senior management or have direct reporting line to senior management; and
• sufficiently skilled, knowledgeable and empowered to drive data protection policies and practices in the organisation.

It is advisable for the DPOs to attend the Fundamentals of the PDPA to gain a good understanding of PDPA and the Practitioner Certificate in PDP (Singapore) to acquire the knowledge and skills needed to establish a robust data protection policies and practices for the organisation. These courses are eligible for funding under the SkillsFuture if you meet the eligible criteria.

Organisations with manpower constraints may outsource operational aspects of the DPO function to a service provider. To be clear, compliance by the organisation with the PDPA remains the responsibility of the organisation.

4. If I have received an email to register my DPO with PDPC, is there a penalty for missing the stipulated deadline mentioned in the email?

While there is no penalty if you miss the deadline, we strongly encourage you to register your DPO via BizFile+ as soon as possible. PDPC may take action against organisations that cannot demonstrate compliance with the PDPA to appoint a DPO, including making the DPO’s business contact information available to the public.

5. What action(s) will PDPC take against my organisation if we failed to appoint a DPO?

The specific enforcement action(s) taken by the PDPC for an organisation’s failure to appoint a DPO will depend on the circumstances of the data breach incident, the organisation’s non-compliance with the PDPA and its response to rectify the situation. Enforcement outcomes could comprise Warnings, Directions or Financial Penalty. Therefore, it is crucial for organisations to comply with the requirement to appoint a DPO, as mandated by the PDPA, and ensure proper data protection governance.

6. How soon must I update the DPO information when there is a change of DPO appointment?

You are strongly encouraged to register your appointed DPO with PDPC as soon as possible. It is important to ensure that the DPO information is accurate and up-to-date, since the information will be publicly available and used by individuals to contact your DPO regarding data protection matters.

7. Is it mandatory for a holding company (with no employee) to appoint a DPO?

An organisation is responsible for all personal data in its possession or under its control. This may relate to not just employees' data but personal data of other persons such as clients or shareholders. The PDPA requires an organisation to designate one or more individuals to be responsible for ensuring compliance with the PDPA.

8. Do I need to appoint a DPO if my organisation is dormant, undergoing liquidation or going to cease its operation in a few months’ time?

An organisation will have to ensure compliance with the PDPA as long as it is collecting, using and disclosing personal data, or has personal data in its possession or control. This includes appointing a DPO. However, registering it via BizFile+ is voluntary if your DPO contact information is already made publicly available.

9. Must the DPO be a Singapore or Singapore Permanent Resident employee that is based in Singapore?

The PDPA does not prescribe the nationality of a DPO and where he/she should be based. In addition, the DPO need not be an employee of the organisation.

However, the DPO whose business contact information provided must be reachable whenever a member of the public in Singapore attempts to contact him, to be compliant with the PDPA requirements. For clarity, it is not mandatory to use a Singapore telephone number though you are strongly encouraged to do so to ease the communication process.