What the PDPA is
The Personal Data Protection Act sets the rules for how organisations in Singapore collect, use and look after personal data. The Personal Data Protection Commission, or PDPC, enforces it.
Personal data is any data that can identify a person, such as a name, phone number, email, NRIC number or photo.
Your main duties
In simple terms, your business should do the following.
- Get consent before collecting personal data, and say why you need it.
- Use the data only for that purpose.
- Protect the data with reasonable security.
- Keep the data only as long as you need it.
- Let people see and correct the data you hold about them.
When a breach happens
You must notify the PDPC if a breach is likely to cause significant harm, or if it affects 500 or more people.
Notify within three calendar days of finding that the breach must be reported. Affected people may also need to be told.
Practical first steps
Start with these basics.
- Know what personal data you hold and where it is stored.
- Limit who can access it.
- Turn on encryption and strong passwords.
- Keep regular backups.
- Train staff to spot phishing emails.