09 Jan PDPA Series: Notice Obligation

NOTICE OBLIGATION

Notify individuals for the purposes for which you are intending to collect, use or disclose their personal data on or before such collection, use or disclosure of personal data, including new purposes not previously notified.

Organisations can put up a Data Protection Policy/Notice to notify individuals about the purposes of collection, usage and disclosure of personal data. The most frequent implementation of this is a data protection policy page on the website. However, if not available online, the policy can be printed as a physical document for the individual to view. The purpose must be stated clearly in the document, whether it is online or printed (offline). Note that the usage should only be for the purposes notified and specified.

Notices and signage are to be placed at collection points. A good example is at the security gantry where a signage can clearly specify the reason for collecting your personal data (to enter the building, or to exchange for an entry pass to the building).

If a verbal consent was obtained from the individual about collection and use of his/her personal data for the purposes specified, make sure to obtain a signed acknowledgement from the individual so to proof that consent was truly given.

Reasonably, the Notice Obligation not only applies to your customers, employers must notify their employees or applicants about the purposes of collection, usage and disclosure of personal data during employment.

You can read the full Notice Obligation from PDPC.