Why this hour is worth your calendar
Personal data is in every part of your business - your CRM, your mailing list, your call scripts. The PDPA says you may only collect, use, and disclose it under clear rules, and the Do Not Call provisions say you must check before you market to a Singapore number. Break either and the Personal Data Protection Commission can act: directions, warnings, and financial penalties that reach seven figures. This track exists so you can make the calls the law leaves to you - fund the right controls, ask your team the right questions, and not learn the rules from an enforcement decision with your name on it.
Two halves of one law 9 min live
The PDPA has two parts a leader needs to hold apart. The data-protection obligations govern how you handle personal data at all. The Do Not Call provisions sit on top and govern one specific thing: marketing messages to Singapore phone numbers. Same law, two rulebooks.
LiveThe data-protection half, in one breath3 min▶
The PDPC lists ten obligations. You do not need them memorised today - session a2 does that - but the shape is simple: get consent for a stated purpose, notify people what you are doing, let them access and correct their data, keep it accurate, protect it, do not keep it longer than needed (retention), be careful sending it overseas (transfer), tell the regulator and people about serious breaches, and be accountable - have a DPO and written policies.
- It applies to all personal data, not just marketing - HR records, customer files, CCTV, everything that identifies a person.
- Data Portability is often mentioned as an 11th - it was passed but is not yet in force, so the current count is ten.
LiveThe DNC half - why marketing is special3 min▶
The Do Not Call provisions exist because people can opt out of marketing. Anyone with a Singapore number can add it to the Do Not Call Registry - three registers, for voice calls, text messages, and faxes. If a number is on the relevant register, you generally may not send it a marketing ("specified") message.
- The core duty: before you market to a Singapore number, you must have checked the register and confirmed the number is not listed - a confirmation that is only valid for a limited window (session b1 has the exact rule).
- Consent is the shortcut: if the person gave you clear, specific consent to market to that number, you can message them even if the number is listed.
- Not everything is "marketing": a delivery notice, a receipt, a B2B message to another company - these fall outside DNC. Knowing what is in scope is half the battle (session a4).
The blast that forgot to check. In a PDPC decision, a financial advisor auto-generated phone numbers, never obtained consent, and never checked the register before making marketing calls to DNC-listed numbers. The PDPC found a breach of the DNC provisions. The lesson is not exotic - it is the ordinary marketing blast that skipped the one check the law requires.
Self-studyWho the PDPC is, and what it can do2 min read▶
The Personal Data Protection Commission (PDPC) administers the PDPA. When something goes wrong it does not always reach for a fine - its published approach is to consider whether directions (fix this, delete that, put controls in place) would remedy the breach first, and to reserve financial penalties for more serious or culpable cases. But the penalties are real and were raised in 2022: for a breach of the data-protection obligations, up to S$1 million, or 10% of annual turnover in Singapore for larger organisations, whichever is higher. The point for a leader is not the ceiling - it is that the regulator weighs how much harm was done and how careless you were. Controls and good-faith effort are not box-ticking; they are what the PDPC looks at.
What it actually costs 8 min live
Abstractions do not move budgets; numbers do. Two kinds of failure carry two kinds of cost, and the PDPC publishes real decisions for both. Here is the shape of the risk.
LiveThe data-leak path - real penalties3 min▶
The most common serious breach is the Protection Obligation: personal data exposed because security was not reasonable. The PDPC's published decisions put numbers on it.
- Marina Bay Sands: an external actor exfiltrated the data of over 665,000 patrons. Finding: inadequate security. Financial penalty: S$315,000.
- Ezynetic (an SME): ransomware exposed the data of ~190,000 individuals. Protection Obligation breach. Penalty: S$17,500 plus directions to fix it. Being small is not a shield - it changes the number, not the obligation.
LiveThe marketing path - and the bought-list trap3 min▶
The marketing failures are more ordinary and often more careless. Beyond the "forgot to check the register" case, the PDPC has acted on where the data came from in the first place.
- The bought-list case: a real-estate salesperson bought around 420,000 personal records from an unknown online seller and used them for telemarketing. Notably, he did check the DNC Registry - but he never verified that those people had consented or been notified. The PDPC found a Consent and Notification breach and imposed a reduced penalty of S$16,800 plus an order to delete the data. Checking DNC does not launder a list you had no right to use.
- The point: DNC compliance and data-protection compliance are two different tests. You can pass one and fail the other. A marketing operation has to satisfy both.
Marina Retail's wake-up call. Our running-case SME (fictional) starts exactly where many do: a customer list nobody is quite sure about, a marketing team that blasts it, and no record of who agreed to what. The practitioner track rebuilds it into an operation that would survive an audit - and it begins with the one question this session raises: where did our data come from, and are we allowed to use it this way?
Map your exposure ★ 12 min · pen and paper
You cannot govern what you have not located. Sketch where personal data and marketing risk actually live in your organisation - no tools, just honesty.
List the 3 biggest pools of personal data you hold (e.g. customer CRM, marketing list, HR records). For each, note roughly how many people and how sensitive.
For each pool, ask: would our security survive the PDPC's "reasonable" test? Mark red / amber / green. Do not solve it - just locate the reds.
Now the marketing angle: list every channel you send marketing on (call, SMS, email, fax). For each, ask "do we check the DNC register, and can we prove consent?" Mark red / amber / green.
Circle the single reddest cell on the page. That is where an enforcement decision would most likely start - and where session by session, this course helps you fix it.
Price a breach ★ 8 min · your next leadership meeting
Turn the real cases into your own number so the risk stops being someone else's headline.
Take your largest pool of personal data. If it leaked tomorrow, roughly how many individuals would be affected? Note whether that is 500 or more - the threshold that makes a breach notifiable.
Estimate the direct costs: notification, investigation, remediation, and a possible PDPC penalty (recall S$17,500 for an SME breach, S$315,000 for a large one).
Now the indirect cost: how many customers would leave, and what is one customer worth over a year? This number is usually larger than the penalty.
Compare the total to what reasonable security would cost. That comparison is the business case you bring to the next budget conversation.
Before session a2 ◐ 30 min total
- Finish your exposure map and keep it - a5 (breach) and a6 (governance) both build on it.
- Run the exposure-mapping prompt on the pool you were least sure about, and note where you could not answer "can we prove consent?"
- Find out who your organisation's DPO is. If the answer is "we do not have one", that is a finding - the PDPA requires one.
- Optional: skim the PDPC website's list of the data-protection obligations, just to see the ten names once before a2 explains them.
- Where does our marketing data come from, and can we prove the people on it consented or were properly notified?
- Do we check the DNC Registry before every marketing send, and who owns that check?
- Which of our data pools would fail the PDPC's "reasonable security" test today?
- If we had a breach affecting 500+ people, do we know we would have to notify the PDPC within 3 days - and who would?
- Do we have a named DPO and a written data-protection policy, or are we relying on good intentions?
Official sources covered
Taught from the PDPC's published guidelines and enforcement decisions - not marketing material. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · The PDPA contains two rulebooks. They are...
The ten obligations govern how you handle any personal data; the DNC provisions sit on top and govern marketing calls, texts, and faxes to Singapore numbers.
2 · A salesperson checked the DNC register but used a list bought from an unknown seller. The PDPC still found a breach because...
In the real case the DNC check was a mitigating point; the breach was of the Consent and Notification obligations. You can pass one test and fail the other.
3 · When the PDPC assesses a data leak, the question it asks about your security is...
The Protection Obligation is about reasonable security. You are not penalised for being attacked - you are penalised for unreasonable arrangements, which you can fund before an incident.