SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
Protection obligation Organisations are required to implement reasonable security arrangements to safeguard personal data in their possession or under their control. These meas - ures must protect against unauthorised access, col - lection, use, disclosure, copying, modification, dis - posal or similar risks. Retention limitation obligation Personal data must not be retained for longer than is necessary to fulfil the purposes for which it was col - lected. Once those purposes are no longer served, and retention is no longer required for legal or business reasons, the data must be deleted or anonymised. Transfer limitation obligation An organisation may only transfer personal data out - side Singapore if it ensures that the recipient jurisdic - tion provides a level of protection comparable to that under the PDPA. Data breach notification obligation In the event of a data breach, an organisation must conduct an assessment to determine whether the breach is notifiable under the PDPA. Where notifica - tion is required, the organisation must notify the Per - sonal Data Protection Commission (PDPC) as soon as practicable and, in any event, no later than three calendar days after making the assessment. In speci - fied cases, affected individuals must also be informed. Accountability obligation Finally, organisations must be able to demonstrate compliance with the PDPA. This includes appointing a data protection officer, developing and implement - ing internal data protection policies and practices, and embedding data protection considerations into organisational governance and operations. Data Subject Rights The PDPA confers a limited set of rights on individuals in relation to their personal data. These rights include the ability to withdraw consent to data processing, to request access to personal data held by organisa - tions, and to seek the correction of inaccuracies or omissions in such data.
Right of access to personal data Under Section 21 of the PDPA, individuals have the right to request access to personal data about them that is in the possession or under the control of an organisation, as well as information about how that data has been used or disclosed within the preceding year. However, access is prohibited under the follow - ing circumstances pursuant to Section 21 (3) of the PDPA: • threaten the safety or health of another individual; • cause immediate or grave harm to the safety or health of another individual; • reveal another individual’s personal data; • disclose the identity of an individual who provided personal data, without that individual’s consent; or • be contrary to national interest. Furthermore, an organisation is not obliged to pro - vide access to an individual’s personal data or related information where the request falls within the situa - tions set out in the Fifth Schedule to the PDPA. Right to correction Under Section 22 of the PDPA, individuals may request the correction of errors or omissions in their personal data. Where a correction is made, the organisation is generally required to send the corrected data to other organisations to which it was disclosed within the preceding year, unless this is unnecessary for legal or business purposes. The correction right does not extend to opinion data or derived personal data, and is subject to exceptions set out in the Sixth Schedule to the PDPA. Right to withdraw consent Under Section 16 of the PDPA, individuals may, upon giving reasonable notice, withdraw any consent (including deemed consent) previously given for the collection, use or disclosure of their personal data. Following withdrawal, the organisation must cease the relevant processing activity unless continued process - ing without consent is authorised or required under the PDPA or other written law. Right to object to marketing See detail set out under “Right to withdraw consent”.
413 CHAMBERS.COM
Powered by FlippingBook