PDPA frequently asked questions
Practical starting points for planning your privacy programme.
Where should PDPA readiness begin?
Map what data you collect, use, disclose and transfer, why you process it, who owns each activity and how long it is kept. Then assess gaps and prioritise risks.
Is consent always required?
Consent is one processing basis. Determine the appropriate basis for each activity and data type, including additional conditions for sensitive data. A single consent form is not a substitute for that assessment.
How do a data inventory and a data flow differ?
An inventory records data and processing details. A data flow shows movement between people, functions and systems. Together they help identify scope and risk points.
Does the organisation need a DPO?
Assess the organisation’s role and processing activities, including their nature, scale and data types, against the applicable legal requirements. Our team can help review the facts before an approach is selected.
How does an outsourced DPO differ from advisory work?
A DPO engagement involves defined responsibilities, independence and communication arrangements. Advisory work may focus on a specific project or topic, so scope and accountability should be clearly agreed.
How should rights requests be handled?
Define an intake channel, ownership, proportionate identity checks, assessment and response tracking, taking account of applicable conditions and exceptions.
How should an organisation prepare for a data breach?
Prepare reporting channels and an incident team, containment steps, fact gathering, risk assessment and a process for determining notification duties. Exercise the plan.
How should third-party processing be managed?
Identify roles and data types, assess provider safeguards, establish relevant agreements, and define access, oversight and return or deletion arrangements.
Does training alone establish readiness?
Training is one part of a wider system of policies, procedures, technical measures, responsibilities and operational evidence. Reassess when activities or systems change.
How are timing and fees estimated?
Timing and fees depend on activities, systems, sites, data types, existing documentation and owner availability. Use the service questionnaire for an initial scoping discussion.
Further guidance: PDPC / GPPC