From seven tasks to one programme
You now have the pieces: applicability, lawful basis, notices, DSARs, records and DPIAs, transfers, breach response. Left as seven separate efforts they decay - someone leaves, a tool changes, and a piece lapses. A programme is what keeps them alive: an owner, a set of living documents, a cadence of review. And because a Singapore company runs the PDPA too, the smart move is to build one programme that answers to both regimes at once.
The programme, assembled 7 min live
Accountability (Art 5(2)) says you must be able to demonstrate compliance. The programme is that demonstration: a hub of artifacts, each of which you already built across this track.
LiveThe artifact checklist3 min▶
- An owner - a DPO or a named responsible person (mandatory under the PDPA; GDPR only in defined cases, but useful regardless).
- Policies + a privacy notice (session b3) - internal rules and the external Article 13 notice.
- A record of processing (b5) - the master inventory everything reads from.
- DPIAs (b5) for high-risk features - and the habit of doing them before launch.
- Transfer mechanisms (b6) - SCCs, TIAs, and measures for every EU-out flow.
- A DSAR flow (b4) and a breach plan (b7) - the two "someone contacts us" pipelines.
- Training + periodic review - because the programme decays without a cadence.
LiveSME help worth using2 min▶
You do not have to build every template from scratch. On the PDPA side, Singapore's PDPC and IMDA offer real starter material - the Data Protection Essentials programme, a DP Starter Kit, a Data Protection Notice Generator, and a self-assessment tool. On the GDPR side, EU supervisory authorities publish SCC templates and guidance. Use them as scaffolding, then adapt to your actual processing - a generated notice that does not match your real data flows is worse than none, because it looks compliant while being wrong.
Stricter of the two 8 min live
The harmonisation rule is simple and powerful: on each dimension, meet whichever regime is stricter, and you satisfy both. Build once to the higher bar.
LiveThe point-by-point rule3 min▶
| Dimension | Stricter regime | Build to |
|---|---|---|
| Lawful basis | GDPR (6 bases, documented) | Record a basis per purpose - covers PDPA too |
| Individual rights | GDPR (erasure, portability, object) | The broader GDPR set - covers PDPA access + correction |
| Breach clock | GDPR (72h from aware) | Hit 72h - comfortably meets PDPA's window |
| DPO | PDPA (mandatory for all) | Appoint one - satisfies both |
| Transfers | GDPR (SCCs + TIA) | Do the GDPR transfer work - meets PDPA comparable-protection |
Notice it is not always the GDPR that is stricter - the PDPA's universal DPO requirement is tougher. So "build to the stricter" is genuinely point-by-point, not "just do GDPR". But on most dimensions the GDPR sets the higher bar, and clearing it carries the PDPA.
LiveOne data map, one owner, one set of pipelines3 min▶
- One record of processing serves both regimes' accountability - do not keep a "GDPR ROPA" and a "PDPA inventory".
- One DSAR/rights pipeline handles GDPR rights and PDPA access/correction, and one suppression list serves both a GDPR objection and a PDPA marketing opt-out.
- One breach plan runs both clocks off the same incident - the 72-hour GDPR notice and the PDPA process.
- One owner (your DPO) holds it all, with a review cadence that catches drift.
Lumina graduates. Lumina began this course as a Singapore SaaS that discovered it was in GDPR scope by accident. It now has one programme: a DPO, a privacy notice that satisfies both regimes, a single record of processing, documented lawful bases, SCCs plus a TIA for its Singapore hosting, one rights pipeline, and a timed breach plan. Same company, now defensibly compliant with the GDPR and the PDPA at once.
Self-studyCompliance is a habit, not a project2 min read▶
The failure mode for privacy compliance is not getting it wrong on day one - it is letting it rot. A programme built and then ignored is worse than honest gaps, because it creates a false sense of safety while the privacy notice describes flows you no longer run and the record of processing omits the tool you adopted last quarter. The fix is cadence: a scheduled review (quarterly is common) where the owner walks the artifacts against reality - has processing changed, has a new vendor become a transfer, did a feature ship that needed a DPIA. Tie the review to the moments that actually change your data footprint: a new market, a new tool, a new feature. For a Singapore company running both regimes, this single review covers both at once - which is the whole payoff of building one programme instead of two. Graduate the way Lumina did, then keep the habit, because the regulators on both sides ask the same question: can you demonstrate compliance today, not just on launch day.
Score your programme + a 90-day plan ★ 10 min · pen and paper
Turn the checklist into a plan.
Score the artifacts. For each - owner, policies + notice, ROPA, DPIA habit, transfer mechanisms, DSAR flow, breach plan, training, review - mark have / partial / missing.
Apply the stricter-of-two lens. For each dimension, note which regime sets your bar and whether you meet it.
Rank the gaps by risk. Transfers and breach readiness usually top the list for a Singapore-plus-EU company.
Write a 90-day plan: the three artifacts you will complete, the owner for each, and the review date you will hold to keep it alive.
After the course ◐ light
- Complete your programme scorecard and 90-day plan, with an owner and a review date on the calendar.
- Consolidate any duplicate GDPR/PDPA documents into one (one ROPA, one rights pipeline, one breach plan).
- Book the first quarterly review, and tie it to your "new market / new tool / new feature" triggers.
- Revisit the applicability checker (b1) whenever your customer base or product changes - and keep learning: the RAG and evals courses on the hub pair well if AI is in your roadmap.
Official sources covered
Taught from the GDPR text, PDPC guidance, and comparative sources. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · The smart way to run GDPR and PDPA together is to...
On each dimension one regime is stricter; meet that bar and you satisfy both. It is point-by-point - the GDPR is stricter on most things, but the PDPA's universal DPO rule is tougher.
2 · Which requirement is STRICTER under the PDPA than the GDPR?
The PDPA mandates a DPO universally; the GDPR only in specific situations. So "stricter of the two" genuinely varies by dimension - here the PDPA sets the higher bar.
3 · The main reason a compliance programme fails over time is...
Compliance is a habit, not a project. Without a review cadence tied to new markets/tools/features, the notice and records drift out of sync with reality - a false sense of safety.