# Singapore PDPA Compliance Workflow Reference

## Workflow 1: Consent Determination

### Step 1 — Assess Consent Type
1. Is express consent obtained? → Express consent (Section 14).
2. Is data voluntarily provided for a stated purpose? → Deemed consent by conduct (Section 15).
3. Can deemed consent by notification apply? → Assess under Section 15A.
4. Does a consent exception apply? → Check Second/Third/Fourth Schedules.

### Step 2 — Deemed Consent by Notification (Section 15A)
1. Conduct adverse effect assessment.
2. Draft notification: purpose, deemed consent mechanism, opt-out period, opt-out method.
3. Deliver notification through reasonable channel (email, letter, in-app).
4. Allow reasonable opt-out period (PDPC recommends minimum 30 days for significant changes).
5. If individual does not opt out within the period, consent is deemed.
6. Record: notification sent, opt-out period, opt-out responses.

## Workflow 2: DNC Registry Compliance

### Before Marketing Campaign
1. Compile list of Singapore telephone numbers for marketing.
2. Submit DNC check request to PDPC DNC Registry.
3. Receive check results; filter out registered numbers.
4. Results valid for 30 days — do not use after expiry.
5. For existing customers: apply the existing customer exemption only if messaging about similar products/services and opt-out is provided.
6. Document DNC check results and campaign records.

## Workflow 3: Breach Notification (Part VIA)

### Day 0 — Awareness
1. Organisation becomes aware of a data breach (actual or suspected).
2. Activate incident response team.
3. Begin 30-calendar-day assessment clock.

### Days 1-30 — Assessment
1. Determine nature and scope of the breach.
2. Identify personal data affected and number of individuals.
3. Assess significant harm criteria (NRIC, financial, health data exposed).
4. Assess significant scale (500+ individuals).
5. If notifiable: prepare PDPC and individual notifications.

### PDPC Notification (Within 3 calendar days of assessment completion)
1. Submit via PDPC data breach notification form.
2. Include: nature, circumstances, data affected, number of individuals, steps taken, DPO contact.
3. Acknowledge receipt from PDPC.

### Individual Notification (As soon as practicable, if significant harm likely)
1. Notify affected individuals directly.
2. Include: nature of breach, steps individual can take to protect themselves, DPO contact.
3. If direct notification is impracticable, use public notification.

## Workflow 4: Data Subject Access Request

### Receipt (Day 0)
1. Request received in writing (email, letter, or portal).
2. Verify identity of requestor.
3. May charge a reasonable fee per PDPC guidelines.

### Fulfilment (Days 1-28)
1. Search all systems for the requestor's personal data.
2. Compile response; redact third-party data.
3. For correction requests: verify the correction and update records.

### Response (Day 30)
1. Provide personal data or confirm correction.
2. If request refused, provide written reasons (exemptions under Fifth Schedule).
3. Inform of right to complain to PDPC.

## Workflow 5: Cross-Border Transfer Assessment

### Step 1 — Determine Transfer Mechanism
1. Assess whether destination provides comparable protection to PDPA.
2. If comparable: document the assessment.
3. If not comparable: implement contractual safeguards (legally enforceable obligations on recipient).
4. Alternative: obtain individual consent with disclosure of inadequate protection.
5. Alternative: APEC CBPR certification.

### Step 2 — Implement Contractual Safeguards
1. Include in contract: purpose limitation, security obligations, breach notification, sub-processing restrictions.
2. Ensure the contract provides individuals with equivalent rights.
3. Record in the transfer register.
4. Review annually.