Singapore Takes Next Steps Towards Updating Its Data Protection Law

Written by: Chase Langhorne, Esq.

In May 2019 Singapore’s data protection authority, the Personal Data Protection Commission (“PDPC”) took steps to update its existing data protection legislation, the Personal Data Protection Act (2012). The PDPC issued a statement regarding their progress and introduced new data breach notification procedures that are expected to be a part of the updated legislation. Those notification measures use deadlines similar to GDPR, but the overall timeline allows for more time than under GPDR. Namely, data breach investigations should be concluded within 30 days from the time a company becomes aware of a potential breach; and if it is determined a breach occurred, and the breach affects more than 500 individuals, then the PDPC must be notified within 72 hours of the completed investigation. This presents a more manageable timeline as opposed to GDPR which requires businesses notify the relevant supervisory authority within 72 hours of becoming aware of a breach. The timeline in the proposed Singapore legislation allows businesses to conduct a more thorough investigation before any notification is due.

Also in furtherance of updating the existing legislation, the government established a new committee, the Public Sector Data Security Review Committee (the “Committee”), to address how public sector data will be handled under the updated legislation. At the end of November, the committee issued five recommendations to be included in the updated legislation, which are as follows:

1. The need to enhance technology and processes to safeguard data against threats.
2. Building data security competencies and training all public officers on data security.
3. Improving the Government’s expertise in data security technology.
4. Amending the Personal Data Protection Act to cover third-party vendors handling Government data.
5. Improving the accountability and transparency of the public sector data security regime.

The Singapore government has accepted the committee’s proposals and plans to implement them by the end of 2021.