Personal Data Protection Act and Its Practical Applications

At the end of this workshop, participants will be able to:

1. Background of PD Protection in the workplace.
2. The objective of the PDPA.
3. Functions of the PDPC.
4. Enforcement of the PD Protection.
5. Data Protection Framework.
6. Who must comply with PDPA?
7. The obligation of the PDPA.
8. Understand how to operationalise the obligations, particularly to NRIC, which came into effect 1 September 2019.
9. Understand how to apply the data breach notifications, which came into effect on 1 February 2021 and what safeguard measures to be adopted.
10. How PD should be collected, used and disposed of for job applicants and resignees activities.
11. The liability for breaching the PDPA and the financial penalties.

A competent HR practitioner must have the skills and knowledge in the following:

1. Introduction to Personal Data Protection Act (PDPA)

• Objectives of the Data Protection Regime.
• Key Terms Personal Data, Business Contact Information (BCI), Individual & Organisations, Data Intermediary and Other Key Terms.
• Mandatory data breach notification, which came into effect 1 February 2021.

2. Data Protection Provisions

• PDPA 10 Key Obligations/ Consent Obligation/ Purpose Limitation Obligation.
• Notification Obligation/ Access & Correction Obligation/ Accuracy Obligation.
• Protection Obligation/ Retention Limitation Obligation.
• Transfer Limitation Obligation/ Data Breach Obligation/ Accountability Obligation
• Existing Data and Other Existing Laws.

3. Collection of personal data by HR practitioners:

i) What constitutes to be consent given by applicants.

ii) What constitutes to be deemed consent by applicants.

iii) Under what circumstances where you need not seek consent from applicants:

• Personal data are publicly available.
• Investigation or proceedings conducted by practitioners and their bearing on applicants.
• Usage of personal data by the HR practitioner for evaluative purposes.
• Document produced in the course of employment.
• Need by practitioners for managing and terminating employment.
• Business asset transaction as required in due diligence context by practitioners.
• Circumstance whereby practitioners need to release personal data to the proper authority:

iv) Withdrawal of consent by employees.

v) Access to personal data by HR practitioners.

vi) Use of personal data by HR practitioners.

vii) Under what circumstances must HR practitioners need to disclose personal data?

viii) Accuracy of personal data as required by HR practitioners.

ix) Protection of personal data as required by practitioners.

x) Retention of personal data as required by HR practitioners.

xi) Liability for breach of personal data by HR practitioners and its bearing on office bearers.

4. HR Practitioner and its duties governing PDPA:

• Taking the role of a Data Protection Officer.
• Developing good policies for handling personal data in an electronic and manual form that suit your organisation’s needs and comply with the PDPA.
• Communicating the internal personal data protection policies and processes to customers, members and employees.
• Handling queries or complaints about personal data from customers, members and employees.
• Alerting your organisation to any risks that might arise with personal data; and
• Liaising with the PDPC, if necessary.
• Liaising with data intermediaries such as payroll vendor.

5. Practitioners as custodian and managing personal data.

• Set out how the personal data in custody may be well-protected.
• Classify the personal data to manage it accordingly.
• Set clear timelines to retain the various personal data and cease to retain documents containing personal data that is no longer required for business or legal purposes.
• The transfer of personal data overseas.

6. The rules governing the collection, use and disclosure of NRIC came into effect on 1 September 2019.

• Collection of NRIC by organisations.
• The alternatives to NRIC numbers.
• Operational perspective on place job advertisements involving NRIC.
• The collection, use and disclosure of NRIC on job applicants, existing employees, and ex-employees.

7. The rules governing data breach notification (DBN) came into effect on 1 February 2021.

• The definition and interpretation of DBN.
• The obligations for the organisation to report to PDPC and the affected individuals.
• The exceptions are that it is not necessary to report data breach to PDPC and the remedial actions.
• The bearing on data intermediary on DBN.
• The penalties for data breach and how to mitigate or safeguard the heavy penalties.
• The need for training and a code of conduct for all employees involves safeguarding personal data and the disciplinary actions for the data breach.

8. Applicability of the PDPA to different situations

• Employment, Receptionist, Security department.
• Photography, recordings and CCTV of job applicants, employees, and ex-employees.
• Personal identification documentation such as NRIC, Passport, Foreign Identification.
• Alternatives to NRIC.
• The permitted situations to collect NRIC.

9. Roles of Data Protection Officer (DPO)

• Appointment of DPO/ Possible Roles of a DPO/ Governance Structures.
• Assessment: Develop a Governance Structure for Your Organisation.
• Under DBN, the need for audit and risk assessment.
• Responsibilities and training requirements for DPO.

Lecture and case study.

Human Resource practitioners

Please visit this page to register.