#
Protection, breach notification, retention and DPO duties are robust and enforced, but there is no formal Records-of-Processing-Activities (ROPA) obligation equivalent to GDPR Art 30.
Sub-modules (7)
Accountability And DpiaAmber
Accountability is now an explicit statutory principle; DPIA-style analysis is triggered only for specific consent exceptions rather than as a general obligation.
Claims (2):
- The accountability principle, initially implied in Sections 11 and 12 of the PDPA, was made an explicit statutory reference through the 2020 amendments.
- The PDPA requires organisations to conduct a form of impact assessment when relying on the legitimate interests exception or on deemed consent by notification, though it does not impose a general DPIA obligation equivalent to GDPR Article 35.
Dpo RequirementsAmber
Mandatory DPO appointment applies to every organisation, without GDPR-style independence or qualification criteria.
Claims (1):
- Although the DPO is not required to be physically present in Singapore, the PDPC expects the DPO to be readily reachable from Singapore and operational during Singapore business hours; the PDPA, unlike the GDPR, does not define specific independence or qualification criteria for the DPO role.
Ropa RequirementsRed
No dedicated Records-of-Processing-Activities obligation was identified in the PDPA or PDPC guidance; the accountability obligation requires internal policies and practices documentation but not a formal register.
Absence provenance: unavailable. Searched: PDPC ROPA records of processing activities requirement, PDPA accountability obligation register of processing.
Joint Controller ArrangementsGreen
Controller-processor liability flows through the controller for data intermediaries; a processor exceeding instructions assumes full Data Protection Provisions liability.
Claims (1):
- An organisation has the same obligations for personal data processed on its behalf by a data intermediary as if the organisation processed the data itself, but a data intermediary that exercises its own judgement beyond the controller's instructions becomes subject to the full Data Protection Provisions for that processing.
Security MeasuresGreen
The Protection Obligation mandates reasonable technical and organisational security arrangements.
Claims (1):
- The Protection Obligation under Section 24 of the PDPA requires organisations to make reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data.
Breach NotificationGreen
Mandatory breach notification is triggered by significant-harm or 500+-individual thresholds, with sector-specific overlay for MAS-regulated financial institutions.
Claims (2):
- A data breach is notifiable to the PDPC and affected individuals if it is likely to result in significant harm to affected individuals or affects 500 or more individuals.
- Financial institutions must separately report data breaches to the Monetary Authority of Singapore where the breach has a severe and widespread impact on the institution's operations or materially affects services to customers.
Retention And DisposalGreen
Retention Limitation Obligation requires cessation of retention once the collection purpose is no longer served.
Claims (1):
- The Retention Limitation Obligation under Section 25 requires an organisation to cease retaining documents containing personal data, or remove the means of associating the data with an individual, as soon as the retention purpose is no longer served and retention is no longer necessary for legal or business purposes.
no periodic updates on record for this sub-brief
Sources and claims (8)
- ProbableOneTrust DataGuidance — The accountability principle, initially implied in Sections 11 and 12 of the PDPA, was made an explicit statutory reference through the 2020 amendments.observed
- ProbableOneTrust DataGuidance — The PDPA requires organisations to conduct a form of impact assessment when relying on the legitimate interests exception or on deemed consent by notification, though it does not impose a general DPIA obligation equivalent to GDPR Article 35.observed
- ProbableOneTrust DataGuidance — Although the DPO is not required to be physically present in Singapore, the PDPC expects the DPO to be readily reachable from Singapore and operational during Singapore business hours; the PDPA, unlike the GDPR, does not define specific independence or qualification criteria for the DPO role.observed
- ProbablePersonal Data Protection Commission — An organisation has the same obligations for personal data processed on its behalf by a data intermediary as if the organisation processed the data itself, but a data intermediary that exercises its own judgement beyond the controller's instructions becomes subject to the full Data Protection Provisions for that processing.observed
- ProbableInternational Association of Privacy Professionals — The Protection Obligation under Section 24 of the PDPA requires organisations to make reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal of personal data.observed
- ProbablePersonal Data Protection Commission — A data breach is notifiable to the PDPC and affected individuals if it is likely to result in significant harm to affected individuals or affects 500 or more individuals.observed
- ProbablePersonal Data Protection Commission — Financial institutions must separately report data breaches to the Monetary Authority of Singapore where the breach has a severe and widespread impact on the institution's operations or materially affects services to customers.observed
- ProbableInternational Association of Privacy Professionals — The Retention Limitation Obligation under Section 25 requires an organisation to cease retaining documents containing personal data, or remove the means of associating the data with an individual, as soon as the retention purpose is no longer served and retention is no longer necessary for legal or business purposes.observed