Name the main obligations under the Personal Data Protection Act and say what each one means in your working day.
Every working day, staff take down phone numbers, update booking records, send files to suppliers and try out new software. Each of these involves information about real people. For private organisations in Singapore, the main law covering that information is the Personal Data Protection Act, or PDPA. You don't need to be a lawyer to work with it, but you do need to know what it asks of your employer, because at work you are the person the company acts through. The obligations below are the ones that come up most often, and the next three lessons apply them to AI.
The Act defines personal data as data about an individual who can be identified from that data alone, or from that data combined with other information the organisation has or is likely to have access to. People tend to forget the second half of the definition. Take a clinic note about "the 34-year-old patient with the knee injury who comes on Tuesday mornings", an invented patient. Her name isn't in the note, but if the clinic's booking system can match those details, staff can work out who she is. Removing a name from a record does not automatically make it anonymous.
Some information is excluded from most of the obligations. The exclusion you'll see most often is business contact information, such as a work email someone gives out for business purposes. The regulator, the PDPC, explains the exclusions on its website. Read that explanation once before you rely on an exclusion.
These three obligations work together. Under consent, an organisation generally needs a person's agreement before it collects, uses or discloses their personal data. The Act sets out situations where consent can be deemed. It also sets out exceptions where consent isn't needed, such as some uses for the organisation's legitimate interests. Those exceptions come with conditions, and someone in the company should decide whether they apply. That decision isn't yours to make alone.
Notification means telling people the purposes for which their data will be collected, used or disclosed, at or before the time of collection. Purpose limitation means using data only for purposes a reasonable person would consider appropriate in the circumstances, and that the person was told about. If you use data for a new purpose the person wasn't told about and didn't agree to, the organisation breaches these obligations.
Daniel, an invented example, runs the front desk and operations at a physiotherapy clinic in Toa Payoh. Last month a patient asked him why the clinic had sent her a promotion for a sister clinic's pilates classes. She had given her number to book an appointment, and she hadn't agreed to receive marketing. Daniel wasn't sure whether she had a point. She did, and the PDPA is the law that says so. She was told her number would be used for appointments. Marketing another business's classes was a new purpose, and she had neither been told about it nor agreed to it. The clinic's intake form now asks a separate question about marketing, so each purpose gets its own answer.
The protection obligation requires an organisation to make reasonable security arrangements for personal data in its possession or under its control. Locked cabinets and passwords count, and so do the tools staff use. Sending data to a service provider does not end the obligation. The organisation is expected to choose providers carefully and to set out in a contract how they must handle the data.
The transfer limitation obligation applies when personal data is sent outside Singapore. The organisation must make sure the data gets a standard of protection comparable to the PDPA's. Many AI services process data on servers in other countries, so transfer limitation comes up often in module 2.
There are other obligations as well. Organisations must let people access and correct their data, keep data accurate, not keep data longer than needed, and notify the PDPC and affected people about certain data breaches. The PDPC website lists all the obligations, with guidance on each.
Under the accountability obligation, an organisation must take responsibility for the personal data in its care. In practice, it is expected to:
have data protection policies make those policies available train its staff appoint at least one person responsible for compliance, usually called the data protection officer
If you paste customer details into a tool the company hasn't approved, the company is answerable to the PDPC and to the customer, even if it didn't know you did it. Your choices about personal data at work affect your employer as well as you. If you make a mistake, tell someone early. A good employer would much rather hear about it then than discover it later.
Every organisation covered by the Act should have someone in the data protection officer role, and that person's business contact details should be publicly available. If you've never known who that is at your workplace, find out. In Lesson 2.4, "Run a PDPA check on three work uses of AI", you'll write their name into a checklist.
The Act, its exceptions and the PDPC's guidance change from time to time. Check the PDPC website for the current version instead of relying on any summary, including these notes.
If Daniel wrote down the PDPA situations from his own working week, his list would start with the patient who received the pilates promotion. Your own examples will probably be just as ordinary. Notice that when you list them: the Act affects the normal working day, and data breaches in the news are only a small part of what it covers.
For each of four PDPA obligations, write one plain sentence saying what it means and give an example from your own job.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).