From tasks to a system
Seven sessions taught you individual duties. But compliance that depends on one person remembering seven duties is one resignation away from collapse. The Accountability Obligation (s.12) exists precisely to prevent that: it asks you to build a durable programme - policies, a DPO, a data map, training, a breach plan, and periodic checks - so the system holds even when people change. That programme has a name: the DPMP. This session assembles yours.
The accountability artifacts 9 min live
A DPMP is not a document - it is a set of living artifacts that fit together. The PDPC's Guide to Developing a DPMP names them, and each one answers a "can you show me?" question. Here is the set, and why each is expected.
LiveThe DPO, policies, and notice3 min▶
The first three artifacts are the backbone of accountability:
- A Data Protection Officer. Appointing a DPO is mandatory, and you must make the DPO's business contact information available - it cannot be a secret role. The DPO owns the programme.
- Internal data-protection policies. Written practices for how your staff handle personal data - collection, use, retention, disposal - plus a complaints process. This is the "did you tell your people what to do?" evidence.
- An external Data Protection Notice. The public-facing statement of what data you collect, why, and how individuals can reach you or exercise their rights. Internal rules and the external promise are two different documents.
LiveThe data map, training, and breach plan3 min▶
The next three make the programme operational:
- A data inventory / data-flow map. What personal data you hold, where it lives, who it flows to. Every earlier session leaned on this - access requests, breach scope, correction pass-ons all need it.
- Staff training and awareness. A policy nobody has read is not a control. Recurring training turns the DPMP from paper into behaviour.
- A data breach response plan. The rehearsed playbook from b7 - who declares, who assesses, who notifies, and where the 30-day and 3-day clocks are tracked.
LivePeriodic self-assessment2 min▶
The last artifact is what keeps the rest honest: periodic self-assessment or audit. A programme that is never reviewed quietly rots - staff change, systems change, new data flows appear. The PDPC provides a free PDPA Assessment Tool for Organisations to run a structured self-check. Put a recurring date on the calendar - annually at minimum - and treat it as a health check, not an exam.
Accountability under s.12 pulls all of this together: develop the policies, put a complaints process in place, communicate the policies to staff, and make information about your practices available on request. The artifacts are how you satisfy it.
Marina graduates 9 min live
We met Marina Retail as a team blasting a stale list and hoping. Eight sessions later, look at the difference - and note that none of it was heroic. It was artifacts, built once and kept alive.
LiveThe journey, session by session3 min▶
Everything Marina built stacks into the DPMP:
| Session | What Marina built |
|---|---|
| b1-b2 | The DNC check-before-send reflex and real, provable consent |
| b3-b5 | The core obligations, notices, and the exclusions worked through in practice |
| b6 | An access and correction request workflow with a 30-day clock |
| b7 | A breach playbook - assess in 30, notify in 3, close the gap |
| b8 | All of it assembled into a DPMP that runs on habit |
No single session was hard. The system is just the sessions, standing together.
LiveSME help you can lean on3 min▶
You do not have to build the DPMP from a blank page. The PDPC and IMDA publish free help aimed squarely at smaller organisations:
- Data Protection Essentials (DPE). A programme designed to help SMEs put baseline data-protection and breach-response practices in place.
- The DP Starter Kit. Templates and guidance to stand up your first policies and notice.
- The PDPA Assessment Tool for Organisations. The free self-assessment that becomes your periodic-audit artifact.
- The Data Protection Notice Generator. Helps you draft the external notice, plus Fundamentals of PDPA training for staff awareness.
Marina uses the tools, not willpower. Rather than write a notice from scratch, Marina's DPO used the Notice Generator for a first draft, ran the PDPA Assessment Tool to find the two weakest obligations, and enrolled the marketing team in Fundamentals of PDPA so the 21-day habit stuck without the DPO policing it. The programme runs because the tools carry the load - not because one person is heroic every day.
LiveMake it a habit, not a heroic one-off2 min▶
The programmes that last are the boring ones: a recurring audit date, a training refresh each year, a DPO whose contact info is actually published, a data map someone updates when a new tool is adopted. Compliance is not a project with an end date - it is a rhythm.
Score Marina's DPMP and build the 90-day plan ★ 10 min
Turn the artifacts into a scored plan. This is the exercise you take back to your own organisation - and the one that turns eight sessions into action.
Score each artifact. DPO, policies + notice, data map, training, breach plan, periodic audit. Rate each red / amber / green for your organisation. Be honest - amber is fine, it is a starting point.
Rank the gaps by risk. Which red or amber artifact, if a request or breach landed tomorrow, would hurt most? That is your first move, not the easiest one.
Map help to gaps. For each gap, name the PDPC/IMDA tool that closes it fastest - Notice Generator, DP Starter Kit, Assessment Tool, DPE, Fundamentals training.
Write the 90-day plan. One owner and one date per artifact for the next 90 days. Reflect - what is the single recurring calendar entry that keeps this alive after day 90?
After the course ◐ 30 min total
- Put one recurring calendar entry in place: your annual PDPA self-assessment. That single date keeps the whole programme alive.
- Run the PDPA Assessment Tool for Organisations once, end to end, and file the result as your first periodic-audit artifact.
- Confirm your DPO's business contact information is actually published where individuals can find it.
- Optional and warmly encouraged: take the leader track (a1-a8) if you brief executives, so the people who set budget understand what you now run. And keep the habit - a programme is only as good as the rhythm behind it.
Official sources covered
Taught from the PDPC's own accountability guidance. This finale covers the working shape of a DPMP - the deep templates live in the guide and SME programmes below.
Three questions before you go 🎯 ◐ 90 seconds
1 · Which of these is a mandatory element of the Accountability Obligation?
Appointing a DPO is mandatory, and the DPO's business contact information must be made available. The other options are not PDPA requirements.
2 · Internal data-protection policies and an external Data Protection Notice are...
They serve different audiences: internal policies tell your staff how to handle data; the external notice tells individuals what you collect, why, and how to reach you. A DPMP needs both.
3 · What keeps a DPMP from quietly rotting over time?
A programme is a rhythm, not a one-off. Periodic self-assessment - the PDPA Assessment Tool on a recurring date - catches the drift as staff, systems, and data flows change.