PDPC · Singapore

PDPA Study Map

DPO Exam Revision
Tap a node to study · drag to pan · scroll / + − to zoom

Readable outline — open in a web browser (Safari/Chrome) for the interactive map.

PDPA Personal Data Protection Act

Eight topic clusters drawn from your notes. Compliance is treated as a continuous cycle — not a one-time checklist.

Tap a branch below to start, or explore from the map.

PDPA Regime The big picture

Singapore's data-protection regime is primarily governed by the Personal Data Protection Act (PDPA), which sets a baseline standard of protection across the economy.

Its core aim is to balance individuals' right to protect their data with organisations' need to use data for legitimate, reasonable purposes. Explore the five facets below.

Core Concepts Foundations

The PDPA balances individuals' right to protect their data against organisations' need to use data for legitimate, reasonable purposes.

Three overarching concepts

  • Consent — generally obtain knowledge & consent before handling data (unless an exception applies).
  • Purpose — inform individuals of the specific reasons for collection, use or disclosure.
  • Reasonableness — only handle data for purposes a reasonable person would find appropriate.

4 Objectives Regime goals

  1. Strengthen consumer trust through organisational accountability — boosting protection to support trust and active participation in the digital economy.
  2. Ensure effective enforcement — robust mechanisms (voluntary statutory undertakings, higher financial-penalty caps) to drive compliance.
  3. Enhance consumer autonomy — give individuals greater control of their data, supported by frameworks like Data Portability.
  4. Support data use for innovation — let organisations confidently harness data for legitimate purposes (with the requisite safeguards & accountability) to improve products and services.

Scope & Exclusions Application

Applies broadly to any individual, company, association or body (formed in Singapore or not) handling personal data. Covers electronic and physical data, whether true or false.

Key exclusions

  • Individuals acting in a personal/domestic capacity.
  • Employees acting in the course of employment.
  • Business Contact Information (BCI) — corporate email, business title, business phone.
  • Public agencies — governed by separate public-sector rules.

Two Pillars DP & DNC

1. Data Protection (DP) Provisions

The bulk of the regime — the 11 Key Obligations (POPCON ExTRAS ADD) governing collection, care of data, and individual autonomy. Accountability underpins them: a proactive, risk-based approach, not a checklist.

2. Do Not Call (DNC) Provisions

Apply to marketing messages (voice, SMS, fax) to Singapore numbers. Organisations must check the DNC Registry before sending, identify the sender, and are barred from dictionary attacks / address-harvesting software.

Enforcement & Penalties PDPC

Enforced by the Personal Data Protection Commission (PDPC). Options range from advisory notices to accepting voluntary undertakings for remediation.

Severe breaches

For egregious or high-impact breaches, the PDPC can investigate and impose financial penalties of up to S$1 million or 10% of annual turnover in Singapore, whichever is higher.

Operationalizing In practice

Every organisation must appoint at least one Data Protection Officer (DPO).

To demonstrate accountability, organisations are encouraged to use frameworks & tools:

  • Build a Data Protection Management Programme (DPMP).
  • Conduct Data Protection Impact Assessments (DPIAs).
  • Use the PATO self-assessment tool.

Breach Notification When to inform

Notify an affected individual only if the breach results, or is likely to result, in significant harm to them.

Scale vs harm

  • ≥ 500 people → notify the PDPC (significant scale).
  • ≥ 500 but no significant harm → you do not notify individuals.

Timing

If required, notify the individual as soon as practicable — at the same time as, or after, notifying the PDPC.

Significant Harm Threshold

Generally met when a full name / alias / full NRIC is compromised together with sensitive data:

  • Financial info (wages, salary, income from sale of goods/property).
  • Medical, health, or life-insurance records.
  • Account identifiers paired with passwords, security codes, biometric data, or access codes.

3 Exceptions No need to notify

Even if the harm threshold is met, individual notification is not required if:

  • Remedial action — taken immediately, making significant harm unlikely.
  • Technological protection — data was encrypted to a reasonable standard.
  • Law enforcement / PDPC — agency prohibits notice, or PDPC waives it.

C.A.R.E. Breach response model

The mandatory steps a data-breach management team should take.

  • C — Contain: act swiftly to stop further compromise; limit damage.
  • A — Assess: circumstances, ease of identifying individuals, and whether it is legally notifiable.
  • R — Report: notify PDPC and/or affected individuals if thresholds are met.
  • E — Evaluate: review the response to improve recovery & prevention.

Contain C

Act swiftly to prevent further compromise and implement mitigating actions to limit damage.

Assess A

Evaluate the circumstances, the ease of identifying individuals from compromised data, and whether the breach is legally notifiable.

Report R

Fulfil obligations to notify the PDPC and/or affected individuals if thresholds are met.

Evaluate E

Review the overall response so recovery and future prevention strategies can be improved.

DPIA Impact assessment

A process & tool to identify, assess and address personal-data risks based on an organisation's functions, needs and processes. (CN: 数据保护影响评估)

Why conduct one

  • Identifies high risks to individuals' data-protection rights.
  • Checks compliance with the PDPA and best practice.
  • Builds safeguards before a system/process goes live.

When

On new IT systems / processes, or when existing ones undergo major changes.

1 · Assess Need Phase 1

Determine if a new/changed system or process involves personal data. Check for new data collection, disclosure to new third parties, or a new/unconsented purpose.

2 · Plan Phase 2

Form the DPIA project team (PM, DPO, steering committee, departmental reps). Define scope, the risk framework & methodology, stakeholders, and timeline.

3 · Identify PD Flows Phase 3

Map how data moves via a Data Inventory Map or Data Flow Diagram. Review documents, contracts, specs; consult departments / on-site inspection.

4 · Assess Risks Phase 4

Check compliance against obligations (consent, notification, purpose limitation) using a checklist. Rate & rank risks by impact and likelihood.

5 · Action Plan Phase 5

Propose technical & organisational measures to treat risks. Assign action owners and set an implementation timeline.

6 · Implement & Monitor Phase 6

Document into a DPIA report (DPO reviews, senior management approves). Owners execute; the DPO monitors results to ensure risks are managed.

DPMP Management programme

A framework to build a robust data-protection infrastructure and demonstrate accountability. A continuous 4-step cycle — plan, implement, review.

Governance & Risk Step 1

Establish a governance structure with leadership to define values and identify data-protection risks.

Policy & Practices Step 2

Develop data-protection policies and clearly designate roles and responsibilities.

Processes Step 3

Design SOPs that operationalise policies into daily business functions.

Review Step 4

Regularly review and update policies & processes; conduct audits to stay current.

11 Obligations Lifecycle loop

Mapped as a continuous lifecycle. Accountability sits at the top as the overarching principle.

Collection Group

  • Notification
  • Consent
  • Purpose Limitation

An organisation can rely on four valid types of consent to collect, use or disclose personal data — explore each below.

1 · Express Consent Consent type

The most straightforward and safest form of consent.

The individual actively agrees to the collection, use or disclosure of their data — e.g. physically signing a form or ticking a checkbox online.

2 · Deemed — Conduct Consent type

Inferred from the individual's actions rather than explicitly given. Applies when someone voluntarily provides their data, fully knowing and understanding the purpose.

Example: giving your home address to a restaurant specifically so they can deliver your food order.

3 · Deemed — Contractual Necessity Consent type

Also inferred, but specifically in the context of a contract. Applies when an individual provides data to enter a contract and processing/sharing it is reasonably necessary to perform or fulfil that contract.

The individual is deemed to consent to

  • The original organisation disclosing data to a third party.
  • The third party collecting and using it.
  • The third party further disclosing it to others to fulfil the contract.

Examples

  • Service delivery (restaurant): ordering via an app — name, address & phone passed to a third-party delivery provider, as that's necessary to deliver the food.
  • Employment: providing your NRIC and bank details to secure an employment contract.

4 · Deemed — Notification Consent type

The organisation clearly notifies the individual of a new purpose for using their data and gives a reasonable period to opt out. If they don't opt out in time, they are deemed to have consented.

Pre-condition

The organisation must first conduct a risk assessment to ensure the new purpose is low risk and won't negatively impact the customer.

Care Group

  • Accuracy
  • Protection
  • Retention
  • Transfer Limitation

Autonomy Group

  • Access & Correction
  • Data Breach Notification
  • Data Portability

Data Portability — limitation

The obligation only applies to data categories that have been 'white-listed' by regulations.

To provide certainty, it is limited to specific white-listed data categories prescribed by regulations — not to all personal data.

Accountability Overarching

The fundamental principle sitting above the whole cycle.

What it means

A risk-based approach to identifying, monitoring, and responding to personal-data risks in order to demonstrate compliance.

It is about being proactive and systematic in managing data risks — showing that the organisation takes responsibility, rather than reacting only after something goes wrong.

DPO vs the organisation

Appointing a Data Protection Officer (DPO) is a requirement — but the accountability for adherence to the Act rests with the organisation as a whole, not the DPO alone.

3PIE Consent exceptions

A mnemonic for the scenarios where an organisation may collect, use or disclose personal data without consent. Three groups of three: 3 P's · 3 I's · 3 E's.

Pair it with POPCON ExTRAS ADD (the 11 obligations) when revising.

Note

Business Contact Information (BCI) is usually grouped with the P's — the PDPA data-protection rules don't apply to it.

3 P's Public & payment

  • Public agency
  • Payment / debt collection
  • Publicly available data

Plus BCI — Business Contact Information (PDPA rules don't apply).

3 I's Interests

  • Legitimate Interest
  • Business Improvement
  • National Interest

Legitimate Interests — mandatory requirement

To rely on this exception, an organisation must conduct an assessment to determine whether its legitimate interests outweigh any adverse effect on the individual.

This is a balancing test and risk assessment — it ensures the organisation's interests do not unfairly harm the individual.

In short, the framework requires balancing the business need against the potential impact on individuals.

3 E's Operational

  • Emergency
  • Employment
  • Evaluation

Scope of 'Evaluation'

The Evaluation exception applies to activities like determining suitability for employment, promotion, or awarding scholarships.

Loyalty programs do not qualify — they usually operate under express consent and count as marketing / business activities, not 'evaluation' in the legal sense.

Tools & Roles Supporting

Self-assessment, accountability and data-mapping instruments referenced across your notes.

PATO Self-assessment

A digital self-assessment tool by the PDPC.

  • Identifies gaps in PDPA compliance from your inputs.
  • Directs you to resources — guidelines, guides, best practices — to close those gaps.

RACI Roles matrix

  • Responsible — does the task.
  • Accountable — ultimate ownership.
  • Consult — asked for input/advice.
  • Informed — kept up to date.

DIM Data map

Documents how data flows through a process — from collection to secure destruction. Usually the first step in building a DPMP.

Pros

  • Easy to develop & maintain.
  • No specialised software needed.
  • No limits on info recorded.
  • Good for extensive, complex flows.

Cons

  • No visual representation (unlike a DFD).
  • Limited at showing interconnectivity across systems.
Breach & response Assessment & mapping Governance & framework Roles & tools