Ten duties, one idea
Session a1 gave you the shape of the whole law - two halves, data protection and Do Not Call. This session opens the first half. The PDPC lists ten data-protection obligations, and every one of them is really a question about a moment in your data's life: how you got it, what you told people, how you look after it, and when you let it go. You do not need to recite the statute. You need to know which questions your organisation can answer with a straight face, and which ones would go quiet in an audit.
The ten, on one page 9 min live
The ten obligations fall into four natural groups, and grouping them is how you remember them. First, how you get data in. Second, the rights you owe the person. Third, how you look after the data while you hold it. Fourth, the safety-net that catches you when something still goes wrong.
LiveGroup 1 and 2 - getting data in, and the rights you owe3 min▶
The first four obligations cover the front door and the person's basic rights. Get these right and most of your risk is already lower.
- Consent - you generally need the person's agreement to collect, use, or disclose their data. Agreement given for one thing does not cover another.
- Purpose Limitation - you may only use the data for the purposes a reasonable person would consider appropriate, and that you told them about. No quietly repurposing the mailing list.
- Notification - you have to tell people the purpose before or at the point you collect their data. Silence is not consent.
- Access and Correction - if someone asks what data you hold on them and how you have used it, you must show them; if it is wrong, you must correct it.
LiveGroup 3 - looking after the data you hold3 min▶
The middle group is about stewardship while the data sits in your systems. This is where the most common failures live.
- Accuracy - make a reasonable effort to keep data accurate and complete, especially if you will use it to make a decision about the person or share it.
- Protection - put reasonable security in place to guard against loss and unauthorised access. This is the single most-breached obligation.
- Retention Limitation - stop keeping data once the purpose is done and there is no legal reason to hold it. Old data you forgot about is pure downside risk.
- Transfer Limitation - if you send personal data outside Singapore, you must ensure it gets a comparable standard of protection there.
Self-studyGroup 4 - the safety-net obligations2 min read▶
The last two obligations exist for when the first eight are not enough, and they are the ones a leader is personally on the hook for.
- Data Breach Notification - if a breach is likely to cause significant harm or affects 500 or more people, you must notify the PDPC (and often the individuals). There is a clock on this, so a plan has to exist before the incident.
- Accountability - you must appoint a Data Protection Officer, and develop and publish data-protection policies. This is not optional. If nobody owns data protection, the organisation is already in breach of this obligation before anything leaks.
The three that cause the most trouble 8 min live
All ten matter, but three of them account for most of the enforcement, most of the confusion, and most of a leader's exposure. If your attention is finite, spend it here: Consent, Protection, and Accountability.
LiveConsent - what it can and cannot demand3 min▶
Consent is where marketing teams most often overreach. Two rules keep you honest.
- You cannot require more than is reasonable. You may not make consent to unrelated data use a condition of providing the product or service. Bundling "agree to marketing" into "agree to buy" fails this test.
- Consent can be withdrawn. A person can withdraw at any time on reasonable notice, and you must give effect to it - a good rule of thumb is around ten business days. After that you must stop the use they withdrew from.
Marina Retail's checkout box. Our running-case SME had a single pre-ticked box at checkout: "I agree to the terms and to receive marketing." Customers who just wanted to buy a kettle were counted as marketing consents. That bundling is exactly what the consent rules forbid - and it means every send built on that list rests on consent that would not survive a complaint.
LiveProtection and Accountability - the two you fund3 min▶
These two are less about individual moments and more about whether the organisation is set up to be trusted with data at all - and both cost money and attention that only a leader can authorise.
- Protection is judged on reasonableness. You are not expected to be un-hackable. You are expected to have security that is reasonable for the sensitivity and volume of what you hold. That is a fundable question you can answer before an incident.
- Accountability is a named person plus a written policy. The PDPA makes a DPO mandatory and requires you to develop and publish your policies. "We take privacy seriously" on a website is not a policy; a real document with an owner is.
Score all ten ★ 12 min · pen and paper
You cannot fix what you have not rated. Run Marina Retail - or better, your own organisation - across all ten obligations and be honest about the colour of each.
Write the ten obligations down the page: consent, purpose, notification, access and correction, accuracy, protection, retention, transfer, breach notification, accountability.
For each, mark red / amber / green. Green means "we could prove this today". Amber means "probably, but it is not written down". Red means "we would go quiet in an audit".
Be strict on the safety-net two: if you have no named DPO or no published policy, accountability is red - no matter how well-meaning the team is.
Count your reds. Most SMEs find three to five. That is not failure - it is a map of exactly what the next four sessions help you close.
Name the first fix ★ 8 min · your next leadership meeting
A scorecard full of reds is a worry. One red with a first step attached is a plan. Turn your weakest obligation into a single concrete move.
Take the reddest obligation from Exercise 1. Write it at the top of a fresh page.
Name the smallest first fix that would move it from red to amber - not the perfect end state, just the first honest step. For a missing DPO, it is "appoint one by name". For weak consent, it is "un-bundle the checkout box".
Assign it: who owns it, by when. An obligation with no owner and no date stays red forever.
Sanity-check the cost of the fix against the risk of leaving it. If the fix is cheaper than one enforcement decision - and it almost always is - you have your business case.
Before session a3 ◐ 30 min total
- Finish your ten-obligation scorecard and keep it - a5 (breach) and a6 (governance) build straight on it.
- Confirm the two accountability facts for real: do you have a named DPO, and is there a published data-protection policy? If either is missing, that is your first red.
- Check one consent path end to end - pick a form or checkout and ask whether the consent it collects is bundled with something else.
- Optional: skim the PDPC's obligations overview once, just to see the ten official names beside the plain-English questions you now use.
- Can we point to a named DPO and a published data-protection policy today, or are we in breach of the Accountability obligation right now?
- Is the consent we collect ever bundled with something else, or forced beyond what the product needs?
- If a customer asked us to stop using their data, how fast could we actually give effect to it?
- Which single obligation is our reddest, and who owns the first fix by when?
- Are we still holding personal data we no longer have a purpose for - and could we prove why we kept it?
Official sources covered
Taught from the PDPC's published guidelines - not marketing material. This page covers:
Three questions before you go 🎯 ◐ 90 seconds
1 · The PDPC's current count of data-protection obligations is...
Data Portability was enacted in 2020 but has not commenced, so it is excluded. The current count is ten.
2 · The Accountability obligation requires an organisation to...
Accountability makes a named DPO mandatory and requires written, published policies. Without them you are in breach before anything leaks.
3 · Under the Consent obligation, an organisation may not...
Consent cannot be forced beyond what is reasonable to provide the product, and it can be withdrawn at any time on reasonable notice.