Personal Data Protection Act (PDPA)
Personal Data Protection Act (PDPA)
Backup = a copy of data that can be used to restore the original in the event that the data is lost or damaged due to hardware failure, human error, or natural disaster
- Made on a regular basis
- Original data not deleted, but older backups often deleted in favour of newer backups
Archive = a copy of data made for long-term storage and references
- Original data may or may not be deleted from source system after the archive copy is made and stored, though it is common for the archive to be the only copy of the data
| Backup | Archive |
|---|---|
| Enables rapid recovery of live, changing data | Stores unchanging data no longer in use but must be retained |
| Multiple copies of data | One copy |
| Restore speed: crucial | Retrieval speed: not crucial |
| Short Term Retention Retained for as long as data is in active use | Long Term Retention Retained for required period or indefinitely |
| Duplicate copies are periodically overwritten | Data cannot be altered or deleted |
Version control
- Ease collaboration across distributed teams
- Much easier to share code changes and coordinate the work of the various team members who are responsible for the database
- Ability to rapidly share and manage changes is particularly important for teams based in diff. locations and evidence shows that teams are increasingly distributed
- Gain better visibility of the development pipeline
- Provides overview of what development work is going on, its progress, who’s doing it, and why
- Maintains detailed change histories and can be associated with issue tracking systems
- Ability to roll back or retrieve previous versions
- Provides an efficient mechanism for backing up the code
- Since the history it provides is incremental, version control lets developers explore diff. solutions and roll back safely in the case of errors
- More readily demonstrate compliance and auditing
- Provides change tracking ⇒ gets ready for compliance, and maintains a robust audit trail and managing risk
- Compliance auditors will require an organisation to account for all changes and detail all those with access to it
Naming convention
- Code written once but read multiple times, by others in project team or even from other teams
- Readability helps in figuring out what the code does in less time
- Common naming convention that everyone agrees to follow ⇒ developers, reviewers and project managers communicate effectively with respect to what the code does
- Result in improvements of communication, code integration, consistency and clarity ⇒ leads to predictability and discoverability (easier to find files)
- Naming a variable – can choose between:
- UPPERCASE
- lowercase
- camelCase (i.e. start with lowercase letter, but new words start with uppercase)
- PascalCaseNames / upper camel (i.e. 1st & all new words starts with uppercase)
- Separate words in names:
- By case (i.e. start each new word with uppercase letter)
- With an underscore (like_this)
- With spaces ⇒ very uncommon
- How to use prefixes:
- With module names
- Prefixing objects with metadata about their type
Data privacy = the requirement for data to be accessed by or disclosed to authorized persons only ⇒ impt that unauthorised people do not have access to data they are not supposed to have
Data privacy or information privacy is a branch of data security concerned with proper handling of data – consent, notice, and regulatory obligations. Revolve around:
- Whether or how data is shared with third parties
- How data is legally collected or stored
- Regulatory restrictions
Why data privacy
- Consumer
- Give more control over personal data
- Allow access and correction of personal data
- Reduces unsolicited (not asked for) telemarketing messages received
- Business
- Builds consumer confidence
- Facilitates cross-border transfer
- Enhances efficiency, branding and competitiveness
Purpose of PDPA
- To govern the Collection, Use and Disclosure of Personal Data by organisations in a manner that recognises both the right of individuals and the need of organisations to collect, use or disclose personal data for Purposes that a reasonable person would consider appropriate in the circumstances
- Collection = actions through which an organisation obtains personal data
- Use = actions through which an organisation employs personal data
- Disclosure = actions through which an organisation discloses, transfers, or otherwise makes available personal data to any other organisation
- Personal Data = data about an individual who can be identified from that data; or from that data and other information that the organisation has or is likely to have access
- Purpose = objectives or reasons
- NOT activities
- When specifying its purposes relating to personal data, an organisation is not required to specify every activity which it may undertake, but its objectives or reasons relating to personal data
- https://www.pdpc.gov.sg/Help-and-Resources/2018/01/E-Learning-Programme
Scope of personal data
- Full name
- NRIC, FIN or passport number
- Photograph or video image of an individual
- Mobile telephone number
- Personal email address
- Thumbprint
- DNA profile
- Name and residential address
- Name and residential telephone number
- Data protection provisions do not cover Business Contact Information (BCI). If such information is not provided solely for personal purposes
- Name
- Business telephone, Business address
- Business email address / fax
- Any other similar information about the individual
- Data protection for organisations
- Organisations collect, use, and disclose personal data about individuals – whether they are customers, employees, or members
- Individuals trust organisations to use and disclose their personal data as it is intended for and to keep their personal data safe
- Practising good personal data management can inc. business efficiency and effectiveness, boost customer confidence, & enhance organisation’s public image
- Organisations in general must comply with the entire PDPA 2012
- https://www.pdpc.gov.sg/Organisations/Organisations-Overview
11 obligations of PDPA
- Consent Obligation
- Only collect, use or disclose personal data when an individual has given consent
- Allow individuals to withdraw consent, with reasonable notice, and inform them of the likely consequences of withdrawals
- Upon withdrawal, and depending on withdrawal request, must cease to collect, use or disclose their personal data
- Purpose Limitation Obligation
- Organisation may collect, use, or disclose personal data about an individual for the purposes that a reasonable person would consider appropriate in the circumstances and for which the individual has given consent
- Organisation may not, as a condition of providing a product or service, require the individual to consent to the collection, use or disclosure of his/her personal data beyond what is reasonable to provide that product or service
- Notification Obligation
- Notify individuals for the purposes for which your organisation is intending to collect, use or disclose their personal data on or before such collection, use or disclosure of personal data
- Accuracy Obligation
- Make reasonable effort to ensure personal data collected by or on behalf of organisation is accurate and complete, if it is likely to be used to make a decision that affects the individual, or if it is likely to be disclosed to another organisation
- Protection Obligation
- Make security arrangements to protect personal data that your organisation possesses or controls ⇒ prevent unauthorised access, collection, use, disclosure or similar risks
- Retention Limitation Obligation
- Cease retention of personal data or remove the means by which the personal data can be associated with particular individuals when it is no longer necessary for any business or legal purpose
- Transfer Limitation Obligation
- Transfer personal data to another country only according to requirements prescribed under the regulations, to ensure that the standard of protection [provided to the personal data so transferred] will be comparable to the protection under PDPA, unless exempted by PDPC
- Access and Correction Obligation
- Upon request, provide personal data of an individual and information about the ways in which his/her personal data may have been used or disclosed in the past year
- Organisations must correct any error or omission in an individual’s personal data upon his/her request
- Accountability Obligation
- More information about your data protection policies, practices and complaints process available on request (i.e. available to consumers)
- Designate 1 or more individuals as a Data Protection Officer (DPO) to ensure the organisation complies with PDPA, including implementation of personal data protection policies within the organisation. The business contact information of at least 1 of such individuals should also be made available to the public. Note: compliance with PDPA remains responsibility of organisation
- To demonstrate organisation is handling personal data responsibly, required to:
- Develop and implement policies for data protection
- Communicate and inform staff about these policies, and include an organisational culture of responsibility among staff through regular training and awareness programmes
- Implement processes and practices that are necessary to meet organisation’s obligations under PDPA. Organisation should be able to demonstrate that personal data is properly managed and protected
- Includes adapting legal requirements into policies and practices, data protection by design, and using monitoring mechanisms and controls to ensure that policies and processes are effectively implemented
- Organisation is answerable to regulatory authorities, business partners, and individuals who entrust the organisation with personal data
- Data Breach Notification Obligation
- In event of data breach, organisations must take steps to access if it is notifiable
- If data breach likely results in significant harm to individuals, and/or are of significant scale, organisations must notify PDPC and the affected individuals as soon as practicable
- Data Portability Obligation
- At request of individual, organisations must transmit individual’s data that is in the organisation’s possession or under its control, to another organisation in a commonly used machine-readable format