SINGAPORE Law and Practice Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
Train staff and raise awareness • Provide periodic training to employees who handle personal data. • Communicate internal policies and expectations relating to personal data protection. Review and maintain compliance • Conduct periodic reviews of data protection poli - cies and practices. • Test breach response readiness (eg, through table - top exercises). • Consider data protection impact assessments for new or significantly changed systems or uses of data. 1.3 Special Categories of Personal Data Processing of Health Data The PDPA does not designate health data as a sepa - rate statutory category of “special” personal data. However, health and medical information is generally regarded as particularly sensitive, and its process - ing is subject to heightened expectations under the PDPA, as supplemented by sector-specific guidance and legislation. The collection, use and disclosure of health data are governed primarily by the general PDPA obliga - tions. PDPC has issued the Advisory Guidelines for the Healthcare Sector (Revised 20 September 2023), which provide practical guidance on how these obli - gations apply in common healthcare scenarios. The guidelines address, among other matters: • the role of consent in clinical care; • circumstances where processing without consent may be permitted; and • the handling of access and correction requests relating to medical records. Organisations handling health data are expected to implement stronger security and access controls, reflecting the sensitivity of such data, and to ensure that collection and use are limited to what is reason - ably necessary for healthcare or related purposes. Retention of medical records must also be justified by ongoing care needs, legal requirements or profes - sional standards.
Individuals may also object to the receipt of specified marketing messages by registering their Singapore telephone numbers with one or more of the national DNC Registers. Registration restricts the sending of telemarketing messages to those numbers, unless clear and unambiguous consent to the sending of the telemarketing message is obtained in evidential form. Right to lodge complaints Individuals may lodge complaints with the PDPC in respect of alleged breaches of the PDPA. The PDPC may facilitate resolution, refer the matter for media - tion, or conduct a formal investigation and take enforcement action where appropriate. Main Compliance Requirements for Organisations The following are the main compliance requirements. Establish data protection governance • Appoint a Data Protection Officer (DPO) and make the DPO’s business contact details publicly avail - able. • Adopt and maintain written data protection policies and documented practices/processes to ensure the organisation complies with the PDPA. Understand and manage personal data holdings • Identify and document personal data assets and data flows across the organisation. • Assess key data protection risks and compliance gaps (including in existing systems and processes). Implement basic operational controls • Put in place procedures for handling access, cor - rection and consent withdrawal requests. • Implement reasonable technical and organisational security measures to protect personal data. • Establish retention and disposal practices to pre - vent unnecessary retention of personal data. Prepare for data breaches and complaints • Establish a data breach response plan and desig - nate a response team. • Implement internal escalation and assessment procedures for suspected data breaches. • Put in place a basic complaint-handling process for data protection matters.
414 CHAMBERS.COM
Powered by FlippingBook