The vocabulary, in one breath

The data subject is simply the person the personal data is about - your customer, your employee, your newsletter reader. It is the term we met at the end of Session 1, and it is the one to keep in your head, because every rule that follows exists to protect this person. When you are unsure whether something is allowed, picture the data subject reading over your shoulder: would they be surprised, or comfortable?

• Always a living person, never a company. A business is not a data subject.
• One record can involve many data subjects - a group photo, a shared chat, a list of attendees.

The controller is the organisation that decides why personal data is collected and how it is used. If you choose to build an email list, and you choose what to do with it, you are the controller of that list. The controller carries the responsibility - it is the one the rules hold accountable. Singapore's PDPA calls this player the "organisation", but the meaning is the same: whoever calls the shots on the data.

• The test is decision-making power: who sets the purpose and the means?
• Two organisations can be joint controllers when they decide together.

The processor handles personal data on the controller's behalf and only does what it is told. Your payroll vendor, your cloud host, your email-sending tool - they touch the data, but they do not decide the purpose. The PDPA name for this role is "data intermediary". The key line is simple: a processor that starts deciding things for itself has quietly become a controller, and picks up a controller's responsibilities.

These are not just tidy words - they decide who is responsible when something goes wrong. The controller owes the duties to the data subject: give notice, respect the purpose, honour rights, keep it safe. The processor owes its duties to the controller: follow the contract, do not go off-script, help when the controller needs to answer a request. When you sign up a new vendor, you are almost always the controller and they are the processor - which means the buck still stops with you. That is why a written agreement setting out what the processor may and may not do is a governance staple, not red tape.

Consent is permission to use someone's data for a purpose you have told them about. Good consent is a clear yes to a clear ask - not a pre-ticked box, not buried in ten pages of terms. And because it is permission for a stated purpose, it does not stretch: consent to email you a receipt is not consent to add you to a marketing list. Consent is one lawful way to use data - there are others - but it is the one beginners meet first, and the easiest to get wrong by being vague.

• Clear, specific, and freely given beats broad and buried.
• People can take it back - see the rights in Part 3.

Purpose limitation is the promise that turns consent into trust: use the data only for the purpose you collected it for. You gathered emails to send order updates - so you do not suddenly sell them, feed them to a new AI experiment, or blast a promotion, unless you go back and ask again. This one rule prevents most "that felt creepy" moments, because surprise is exactly what it rules out. Its close cousin is data minimisation: collect only what the purpose needs, and keep it only as long as the purpose lasts.

Notice (some laws say notification) is simply telling people what you collect, why, and what you will do with it - before or as you collect it. It is the privacy notice on your website, the line under a signup form, the short explanation at the till. Good notice is honest and readable; nobody is served by a wall of legalese. Notice is what makes consent meaningful: you cannot truly agree to something you were never told.

Carrying over from Session 1: personal data is anything that can identify one living person, and sensitive data (the GDPR's "special category") is the slice that could hurt most if mishandled - health, race, religion, sexual orientation, political views, biometrics. The promises above apply to all personal data, but sensitive data raises the bar on every one of them: you need a stronger reason to collect it, tighter protection while you hold it, and more care before you share it. When you meet the vocabulary in the wild, watch for phrases like "we may use your health information" - that is a signal the highest bar should be in play.

You do not need the article numbers. You need to recognise these when a person asks, and know that a working organisation can answer:

• Be informed - know what you hold about them and why (this is notice, from their side).
• Access - get a copy of the personal data you hold about them.
• Correct - fix data that is wrong or out of date.
• Withdraw consent - change their mind and have you stop the use they agreed to.
• Erase (GDPR) - the "right to be forgotten": ask you to delete their data in certain cases.
• Port (GDPR) - get their data in a common format to take elsewhere; the GDPR also adds a right to object.

The shared spirit is the first four - Singapore's PDPA gives access, correction, and withdrawal, and informs people through notice. The GDPR layers on erasure, portability, and objection. For this on-ramp, hold the shape: find it, show it, fix it, stop it - and know the EU asks for a little more.