Introduction & Applicable Laws
The first workshop lays the foundation. The team learns the essential data protection concepts and the obligations of the PDPA, identifies which other laws and guidelines apply to the organisation, defines the scope of the programme and agrees on the team and schedule for all 13 workshops.
Workshop 1 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Workshop 1 as a ready-made objective: every task with guidance, expected result and due dates in the Objective Manager
- Training slides for the fundamentals session, with the rules of your jurisdiction on every slide
- Template for the data protection scope document: applicable laws, scope and roles
- Data Protection Assessment: a checklist of your jurisdiction's obligations with an automatic action plan and compliance score
Workshop tasks
-
1. Data protection fundamentals
Make sure the team shares the same concepts: personal data, collection, use and disclosure, organisation and data intermediary, and the individual. Walk through the PDPA obligations one by one.
Presentation: open the slides for this task -
2. Identify applicable laws
Determine which laws apply: the PDPA, sector rules (for example MAS requirements for financial institutions), laws of other countries where the organisation operates or whose residents it serves, and contractual commitments to clients. Document them in the data protection scope document, starting from its template in the Policy Framework.
In ResGuard: Policy Framework -
3. Define the programme scope
Define which entities, locations, processes and groups of individuals (customers, employees, job applicants, vendors, visitors) the programme covers, and document them, including any exclusions, in the same data protection scope document.
In ResGuard: Policy Framework -
4. Project team & roadmap
Name a management sponsor, a programme lead and contacts in HR, IT, sales and marketing. Plan dates and participants for each workshop and set up the roadmap as workshop objectives with their dates.
In ResGuard: Objective Manager -
5. Initial data protection assessment
Answer the data protection assessment for each entity in scope: compliant, partially compliant, not compliant or not applicable. Confirm the measures you answered as compliant in the action plan, so the compliance score shows where you stand today. Management sees this baseline in Workshop 2.
In ResGuard: Data Protection Assessment -
6. Workshop review & close-out
Review the results with the data protection lead, attach evidence, log open points as new tasks and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind under the PDPA
- Main law: the Personal Data Protection Act 2012 (PDPA), as amended in 2020, with the Personal Data Protection Regulations 2021.
- Authority: the Personal Data Protection Commission (PDPC), part of the Infocomm Media Development Authority (IMDA).
- The PDPA obligations: Accountability, Notification, Consent, Purpose Limitation, Accuracy, Protection, Retention Limitation, Transfer Limitation, Access and Correction, and Data Breach Notification. The Data Portability Obligation has been passed but is not yet in force.
- Add the PDPC Advisory Guidelines relevant to your organisation to the scope document, for example on key concepts, NRIC numbers, children's personal data or your sector.
Expected result
- The project team understands the core concepts and the PDPA obligations
- Applicable laws and guidelines documented in the data protection scope document
- Data protection scope document approved by management in the Policy Framework
- Project team and roadmap for all 13 workshops set up in the Objective Manager
- Initial data protection assessment completed and baseline compliance score available
ResGuard modules: Policy Framework, Data Protection Assessment, Objective Manager