Personal Data Inventory
The personal data inventory is the central record of how the organisation collects, uses and discloses personal data. The PDPA does not prescribe a specific record, but without it you cannot show compliance with the other obligations. Almost every following workshop builds on it.
Workshop 3 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Records of processing (RoPA) module with a library of ready-made processing activities
- Training slides with an explanation and a practical example for every task
- Built-in fields for data, data subjects, purpose, legal basis, retention and recipients, so nothing is forgotten
- Links to departments, applications and vendors, and an Excel export for auditors
Workshop tasks
-
1. Identify processing activities
Run short interviews with each department: HR (recruitment, payroll, attendance), sales and marketing (customers, newsletters, website), finance (invoicing, collections) and IT (accounts, email, CCTV).
In ResGuard: Data InventoryPresentation: open the slides for this task -
2. Data, individuals & flows
For each activity, document the data categories, whether sensitive data such as NRIC numbers is involved, the individuals, the source, the recipients and the systems. Remove data that is not needed.
In ResGuard: Data InventoryPresentation: open the slides for this task -
3. Purpose & consent basis
Describe a concrete purpose and record the basis: consent, deemed consent or an exception such as legitimate interests or business improvement.
In ResGuard: Data InventoryPresentation: open the slides for this task -
4. Consent management
Where processing relies on consent, document how it is obtained, how it is recorded so it can be proven, and how withdrawal is handled.
Presentation: open the slides for this task -
5. Retention & transfers
Record the retention period and transfers outside Singapore or within the group. They are the basis for workshops 6 and 10.
In ResGuard: Data InventoryPresentation: open the slides for this task -
6. Review & maintenance
Assign an owner to each activity, define an annual review and the triggers for updates: new systems, purposes or vendors.
Presentation: open the slides for this task -
7. Workshop review & close-out
Review the complete inventory with the DPO, attach evidence and close the objective in ResGuard.
In ResGuard: Objective ManagerPresentation: open the slides for this task
What to keep in mind under the PDPA
- Deemed consent covers consent by conduct, by contractual necessity and by notification. Deemed consent by notification and the legitimate interests exception both require a documented assessment of adverse effects on the individual.
- Following the PDPC Advisory Guidelines, collect NRIC numbers (and copies of NRIC) only where required by law or necessary to accurately establish an individual's identity to a high degree of fidelity.
- Business contact information is excluded from most PDPA obligations; you can mark it as such in the inventory.
- Personal data used to manage or terminate an employment relationship can be collected without consent, but employees must still be told the purposes.
Expected result
- Processing activities from all departments recorded
- Data, individuals, purpose and consent basis documented per activity
- Retention periods and transfers recorded
- Owners and review cycle assigned
ResGuard modules: Data Inventory (RoPA)