PDPA TRAINING

It is well-established that proper training is a key security arrangement in an organisation’s compliance with the protection obligation under section 24 of the PDPA. Proper staff training – which creates data protection awareness amongst employees, imparts good practices in handling personal data and puts employees on the alert for threats to the security of personal data – is necessary to complement an organisation’s data protection policies. 

PDPC’s decision in MCST no. 3593 [2020] SGPDPC 6

In Tanah Merah Country Club [2021] SGPDPCS 16, the Commission had emphasised that staff training is a critical and necessary component to ensure that an organisation is well placed to protect the personal data in its possession and/or control. The Protection Obligation extends to and includes the training of all employees who have to handle personal data in the course of their work so that an organisation’s employees can then successfully adopt and implement the policies and best practices necessary to ensure the protection of personal data in an organisation’s possession and/or control.

PDPC’s decision in Consumers’ Association of Singapore (CASE) [2024] SGPDPC 4