PDPA Implementation Guide
Data Protection in Singapore

From first practice to a running programme

This guide is for the Data Protection Officer and the team who implement the PDPA in their organisation, whether you are setting up data protection for the first time or bringing an existing programme up to date.

Instead of one large project, the work is split into 13 workshops. Each workshop covers one topic, has a clear objective, a set of concrete tasks and a result you can verify. Together they build the Data Protection Management Programme (DPMP) the PDPC expects every organisation to have.

The workshop approach

Every workshop follows the same four steps, so your team always knows what comes next:

1. Watch the intro video. Each workshop page starts with a short video that explains the topic and shows the tasks in ResGuard with a screen recording.
2. Run the workshop session. Bring the DPO together with the people who know the processes, such as HR, IT, sales and marketing. Data protection is not just the DPO's job.
3. Work through the tasks. Each workshop is available in ResGuard as an objective with its tasks, so progress, owners and evidence are tracked in one place, with templates in the policy library.
4. Close out the workshop. Review the result with the DPO, attach evidence and log open points as new tasks before moving on.

Follow the workshops in order: each one builds on the results of the previous ones, especially the personal data inventory from Workshop 3. Workshops with different teams can run in parallel once the inventory is in place.

Everything you need is built into ResGuard

You never start from a blank page: the tool provides everything you need to meet your compliance obligations, and keeps track of it for you.

• Templates for every required policy, procedure and document, and privacy notices generated from your records of processing
• Guidelines: every workshop is a ready-made objective with tasks, expected results and due dates, supported by training slides and videos
• Checklists for the obligations of your jurisdiction, security measures, DPIA risks, data breaches, vendor questionnaires and audits
• Reminders and notifications: policy acknowledgements, training, new requests from individuals and audit questionnaires are followed up automatically by e-mail
• Request Portal: a compliant intake channel where individuals submit their requests online, with response times tracked for you
• Reports: your compliance score and a data protection report for management with one click

The 13 workshops

Foundations

1. 1 Introduction & Applicable Laws Core concepts, the PDPA obligations, programme scope, project team and initial assessment. 2 weeks
2. 2 Governance, Roles & DPO Management commitment, DPO appointment, RACI matrix and reporting to management. 1 week

Inventory & transparency

1. 3 Personal Data Inventory Inventory of all personal data: data, individuals, purpose, consent basis and retention. 3 weeks
2. 4 Notification, Consent & Transparency Notify individuals of purposes, obtain consent and handle withdrawals. 1 week

Rules & individuals' rights

1. 5 Data Protection Policies Overall policy, supporting procedures, approval and employee acknowledgement. 2 weeks
2. 6 Data Retention & Disposal Retention schedule, disposal methods and regular reviews. 1 week
3. 7 Access & Correction Requests Intake channels, identity checks, procedure and response timelines. 1 week

Risk, protection & third parties

1. 8 Risk Assessment & DPIA Find high-risk processing, assess it and apply data protection by design. 2 weeks
2. 9 Protection Measures Assess security arrangements, close gaps and document them. 2 weeks
3. 10 Vendors, Data Intermediaries & Transfers Application and vendor inventory, assessments, contracts and overseas transfers. 2 weeks
4. 11 Data Breach Management Detect, assess and notify data breaches. 2 weeks

Culture & continuous improvement

1. 12 Awareness & Training Role-based training plan, tracking and ongoing awareness. 1 week
2. 13 Monitoring, Audits & Continuous Improvement Key indicators, internal audits, corrective actions and annual management review. 1 week

Need support?

If your team needs guidance, our Outsourced DPO service can take on the DPO role or support your internal lead throughout the programme. Once the programme is running, the DPTM certification lets you demonstrate it to customers and partners.