Creating a good PDPA compliance framework

PRIVATE organisations have had to comply with the Personal Data Protection Act (PDPA) since it came into effect in Singapore on July 2, 2014. The PDPA governs the collection, use and disclosure of personal data such as a customer's name, age and e-mail address that is collected in the course of delivering goods and services.

While most organisations know that violating the PDPA can result in severe punishment, many are unsure about compliance. This is where internal auditors can help, not just with advice on an overall framework for compliance but also through independent reviews.

Here are eight tips to creating a good compliance framework:

1 Appoint a data protection officer

Organisations have to appoint a data protection officer to ensure compliance. The data protection officer needs to be very familiar with the scope, requirements and expect…