Why rights are the sharpest GDPR-PDPA gap
Scope decides whether the GDPR applies; rights decide what you owe the people whose data you hold. This is where the two regimes diverge most. The PDPA gives individuals two enforceable rights in practice - access and correction. The GDPR gives eight, including some that can force you to delete data or hand it over in a portable file. A Singapore company that becomes GDPR-subject inherits a to-do list of rights it never had to build for.
The eight rights 9 min live
The rights sit in Articles 12-22. You do not need the article numbers in a meeting, but you do need to recognise each right when a customer invokes it - and know the clock you are on.
LiveThe rights, in the order they get used3 min▶
- Be informed (13/14): tell people what you do with their data, at collection - the privacy notice (session b3).
- Access (15): give them a copy of their data plus how it is used.
- Rectification (16): correct errors.
- Erasure / right to be forgotten (17): delete in defined circumstances (no longer needed, consent withdrawn).
- Restriction (18): "freeze" processing while a dispute is resolved.
- Portability (20): hand data back in a structured, machine-readable file they can take elsewhere.
- Object (21): stop processing - and for direct marketing, it is an absolute stop.
- Automated decisions (22): not to be subject to solely automated decisions with legal or significant effects, with exceptions.
LiveThe one-month clock3 min▶
Every request runs on the same clock: respond without undue delay and within one month of receipt (Art 12(3)). You can extend by up to two further months for complex or numerous requests - but you must tell the person, with reasons, within the first month.
- The leadership read: this is an operational commitment. If a request lands and nobody owns it for three weeks, you have already half-spent your month.
- Free by default: you generally cannot charge; a reasonable fee (or a refusal) is only for manifestly unfounded or excessive requests.
Lumina's first erasure request. An EU user asked Lumina to delete their account and all data. Under the PDPA, Lumina had never built an erasure flow - only correction. Under the GDPR it had one month to actually delete, across its database and backups, and confirm. The request exposed a capability the PDPA never required.
What the PDPA does not give 8 min live
If you have built request-handling for the PDPA, you have built access and correction. The GDPR adds four rights with no live PDPA equivalent - and those are exactly the ones that need new process.
LiveThe four you have to add3 min▶
- Erasure (17): the big one operationally - you must be able to actually delete a person's data, including from the systems it flowed into.
- Restriction (18): a "pause" state your systems must support while a dispute runs.
- Object (21): a genuine stop - and for direct marketing there is no balancing, it is absolute.
- Automated decisions (22): if you make solely automated decisions with significant effects, individuals can demand human review.
- Portability (20): legislated in the PDPA (Part 6B) but not yet in force - so under the GDPR you must offer it now, under the PDPA not yet.
Self-studyWhere PDPA marketing rights actually live2 min read▶
One apparent gap is not really a gap. The GDPR's "right to object to direct marketing" (Art 21) has no PDPA rights-equivalent - but Singapore handles marketing through an entirely separate mechanism: the Do Not Call provisions, a registry-and-consent regime rather than an individual right. So a Singapore company already has a marketing-opt-out muscle; it is just built in a different place. For a dual-regime operation, the practical move is to let a single "stop marketing me" signal satisfy both the GDPR objection right and the PDPA DNC/consent-withdrawal path, rather than running two disconnected suppression lists.
Audit your request-handling ★ 12 min · pen and paper
Find out which regime your current process was built for.
List the data-subject requests your company can actually handle today. Most SG-first companies will list access and correction.
Now check the four GDPR-only rights: could you erase a person's data everywhere? Freeze it? Honour an objection? Give a human review of an automated decision? Mark each yes/no.
For every "no", note the systems that would need to change (the CRM, the data warehouse, backups). Erasure usually touches the most.
Circle the one right you are least ready for. That is your biggest GDPR rights gap - and where the practitioner track (b4) starts.
Set the one-month drill ★ 8 min · your next ops review
A right you cannot deliver in a month is a right you do not really have. Pressure-test the clock.
Pick the request type you get most (usually access). Trace who receives it, who acts, and how long each hop takes today.
Add it up. If the honest total is over a month, you have a compliance gap before anyone even does the work.
Name a single owner and an intake channel. Requests that bounce between inboxes are how the month gets lost.
Decide your extension policy: what counts as "complex", and who signs off telling the person within the first month.
Before session a4 ◐ 30 min total
- Finish the rights audit and keep it - session b4 turns the gaps into a request-handling workflow.
- Trace your access-request clock end to end and note where the month leaks.
- Check whether your marketing opt-out (PDPA/DNC) and a GDPR objection would hit the same suppression list, or two different ones.
- Optional: skim GDPR Articles 15 and 17 - access and erasure, the two you will use most.
- Which data-subject requests can we actually fulfil today, and which four GDPR rights are we not built for?
- Could we truly erase a person's data everywhere, including backups and downstream systems?
- What is our real end-to-end time to answer an access request - is it under a month?
- Who owns data-subject requests, and through what single intake channel?
- Do a GDPR objection and a PDPA marketing opt-out feed one suppression list or two?
Official sources covered
Taught from the GDPR text and reputable comparative guidance. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · The standard GDPR response time for a data-subject request is...
Article 12(3): without undue delay and within one month; extendable by two further months for complex/numerous requests, with notice in the first month.
2 · A GDPR right that the PDPA does NOT currently give individuals is...
Access and correction exist under both. Erasure, restriction, objection and automated-decision rights are GDPR-only; portability is legislated in the PDPA but not in force.
3 · The safest way to build request-handling for a dual-regime (GDPR + PDPA) company is to...
The GDPR set is a superset of what the PDPA requires here. Build to the broader standard once, rather than leaving four rights unbuilt.