ShareAndGoShareAndGo

Compliance

Data protection is a board question in Singapore. Here is what to ask.

Personal data sits in almost every document a company shares: employee files in a sale, customer records in an audit, director details in a fundraise. When something goes wrong with that data, the consequences reach the organisation itself, and so the questions belong in the boardroom, not only with IT.

This piece sets out what the PDPC and MAS have published about responsibility, penalties and breach response, and turns it into questions a board can ask. It is general information, not legal advice. Directors should take advice on their own position.

Get started

Accountability stays with the organisation

The Personal Data Protection Act requires every organisation to designate one or more individuals to be responsible for ensuring it complies with the Act. The PDPC's Advisory Guidelines on Key Concepts in the PDPA explain that this person is usually called the Data Protection Officer, or DPO, under section 11(3).

The same guidelines make a point boards sometimes miss. Section 11(6) says designating a DPO does not relieve the organisation of any of its obligations. Legal responsibility for complying with the PDPA remains with the organisation and is not transferred to the person designated. Appointing a DPO is a start, not a hand-off.

The guidelines also say the DPO should ideally be a member of senior management or have a direct reporting line to it, and describe the commitment and involvement of senior management as key to accountability and oversight. Section 11(5) requires the organisation to make available the business contact information of at least one designated individual.

Questions for the board

  • Who is our DPO, and do they report to senior management directly?
  • Is their business contact information published where people can find it?
  • Do they have the time, training and authority to do the role, or is it a title added to a full-time job?
  • When did the board last hear from them, and what did they report?

What a breach can cost

The PDPC's Advisory Guidelines on Enforcement of the Data Protection Provisions set out the financial penalties available under section 48J of the PDPA. For an intentional or negligent contravention of the data protection provisions, the PDPC may impose a financial penalty of up to S$1 million or 10% of the organisation's annual turnover in Singapore, whichever is higher. The 10% limb applies where annual turnover in Singapore exceeds S$10 million, and turnover is taken from the most recent audited accounts available when the penalty is imposed.

These are maximums, and the guidelines describe how the PDPC weighs harm, culpability and other factors in deciding an amount. For a board, the useful point is that the ceiling scales with the size of the business, so the exposure grows as the company does.

The breach clock

The PDPC's Guide on Managing and Notifying Data Breaches under the PDPA sets out two time limits that every board should know. Once an organisation has credible grounds to believe a data breach has occurred, it must take reasonable and expeditious steps to assess whether the breach is notifiable, within 30 calendar days. Once it determines the breach is notifiable, it must notify the PDPC as soon as practicable and no later than three calendar days, and notify affected individuals, where required, as soon as practicable, at the same time as or after notifying the PDPC.

A breach is notifiable where it is likely to result in significant harm to the affected individuals, or where it is of a significant scale, which the guide describes as involving the personal data of 500 or more individuals. The guide also says the organisation must document the steps it takes in assessing a breach.

Three calendar days is short. It includes weekends. The work that makes it achievable is done in advance: knowing where personal data is, who can reach it, and having records that show what happened.

Questions for the board

  • If we discovered a breach on a Friday, who would decide by Monday whether it is notifiable?
  • Could we tell, from records, which documents were opened and by whom?
  • Where is personal data shared outside the company today, and with what controls?
  • Who documents the assessment, and where is that record kept?

For financial institutions: MAS technology risk

Boards of MAS-regulated institutions have a further reference point. MAS's Technology Risk Management Guidelines, issued in January 2021, say both the board of directors and senior management should have members with the knowledge to understand and manage technology risks, including risks posed by cyber threats. They say the board and senior management should ensure a Chief Information Officer or Head of IT and a Chief Information Security Officer are appointed, and set the tone from the top for a culture of technology risk awareness.

The guidelines list responsibilities for the board or a delegated committee, including approving the risk appetite and risk tolerance statement for technology risk and ensuring an independent audit function assesses the effectiveness of controls. Even boards outside the financial sector may find the list a useful model.

Where document sharing fits

Most data protection conversations at board level are about systems: the customer database, the payroll platform. Shared documents are easier to forget, because they leave the company one email at a time. That is exactly why they deserve a line in the board's questions.

A virtual data room such as ShareAndGo changes what a board can be told about shared documents. Instead of an inbox trail, there is a room with defined groups, each seeing only the folders allowed. View-only recipients see watermarked pages rendered on our side, and never receive the original file. Invitations have end dates and can be revoked at any time. And there is an audit log of every view, upload, download, invitation and change, chained so that an alteration shows up, and exportable as CSV for the DPO or an adviser.

That does not answer the board's questions on its own. It means that when the board asks who saw a document, there is an answer.

Questions people ask

Does appointing a DPO make the DPO personally responsible?
The PDPC's Advisory Guidelines on Key Concepts explain that, under section 11(6) of the PDPA, designating a DPO does not relieve the organisation of its obligations. Legal responsibility remains with the organisation. Take advice on any individual director's position.
What is the maximum PDPA financial penalty?
According to the PDPC's enforcement guidelines, up to S$1 million or 10% of annual turnover in Singapore, whichever is higher, with the 10% limb applying where Singapore turnover exceeds S$10 million.
How quickly must a notifiable breach be reported?
The PDPC's breach guide says no later than three calendar days after the organisation determines the breach is notifiable, with the assessment itself to be done within 30 calendar days of credible grounds to believe a breach occurred.

Keep reading

MAS guidance on cloud

What MAS outsourcing guidance says about cloud services for regulated records.

How a tamper-evident audit log works

Why a chained log is a better record than a list of timestamps.

Security

How ShareAndGo protects the documents you share.

Give your board a record of every shared document.

Groups, watermarks, end dates and a chained audit log in every room.

Get started