Notification, Consent & Transparency
Individuals have to know why their data is collected, and in most cases agree to it. Based on the inventory, this workshop identifies every point where data is collected and prepares clear notifications and consent wording for each group of individuals.
Workshop 4 video
Quick intro with a screen recording of the tasks — coming soon
What ResGuard provides
- Privacy notice generated from your RoPA in one click, with every placeholder still to complete highlighted
- Ready-made privacy notice template for the PDPA
- Your own Request Portal linked in the notice automatically
- Employee notices distributed and acknowledged through the Policy Framework
Workshop tasks
-
1. Identify collection points
List where data is collected: website, forms, cookies, apps, contracts, job applications, intranet, CCTV, visitor registration and events.
In ResGuard: Data Inventory -
2. Define notice content
Include the purposes, how to contact the DPO, how consent can be withdrawn and, where useful, recipients, transfers and retention. Most of it comes straight from the inventory. A draft with the mandatory content can be generated from the RoPA with Generate Privacy Notice.
In ResGuard: Data Inventory → Generate Privacy Notice -
3. Draft & approve notices
Write one notice per group of individuals in plain language, using a layered approach: a short summary at the collection point and the full data protection policy behind a link. Start from the generated notice, complete the highlighted placeholders and approve it in the Policy Framework.
In ResGuard: Data Inventory → Generate Privacy Notice, Policy Framework -
4. Publish & keep current
Publish each notice at its collection point, keep previous versions and update notices whenever an activity in the inventory changes. Generate the notice again when the RoPA changes and compare it with the published version.
In ResGuard: Policy Framework -
5. Workshop review & close-out
Review the published notices with the DPO, attach evidence and close the objective in ResGuard.
In ResGuard: Objective Manager
What to keep in mind under the PDPA
- Purposes must be notified on or before collecting the data, and for any new purpose before the data is used for it.
- When an individual withdraws consent, inform them of the likely consequences and stop the collection, use and disclosure within a reasonable time.
- Before sending marketing messages to Singapore telephone numbers by call, SMS or fax, check the Do Not Call (DNC) Registry unless you hold clear and unambiguous consent.
- For CCTV, put up notices at the entrances of monitored areas.
Expected result
- Complete inventory of collection points
- Notices for customers, website users, employees, job applicants and vendors
- Notices approved in the Policy Framework and published
- Consent withdrawal process in place
ResGuard modules: Policy Framework, Data Inventory (RoPA)