- POSTED: 24 Jun 2014 19:34
- UPDATED: 24 Jun 2014 23:08
50 per cent of organisations surveyed say they have adequate measures in place for the Personal Data Protection Act, but the Association of Small and Medium Enterprises says not all firms have the means to comply with the new rules.
SINGAPORE: With about a week to go before the Personal Data Protection Act (PDPA) kicks in on July 2, one in two organisations surveyed say they have put adequate measures in place to deal with the changes.
These figures are from an Industry Readiness Survey conducted by the Personal Data Protection Commission (PDPC) from February to April this year, and the number of PDPA-ready companies is expected to increase over time.
To that end, the PDPC has been conducting briefings to inform and educate more about how the PDPA works. These efforts have reached some 12,000 people thus far.
Global Wellness Holding is one firm that has tweaked its information management practices, to keep in line with the PDPA.
The spa business has implemented measures to seek explicit permission from clients when seeking their personal data. On its website, there is a consent form that tells people how their personal data will be used. After you agree to the conditions, you fill in details like your name, mobile number and email address.
The firm has also appointed a data protection officer, as required under the Act. It has even taken the step of forming a data protection committee comprising staff members that handle customer information, and hired consultants to help the company align with the Act.
However, the Association of Small and Medium Enterprises (ASME) said not all firms may have the means to take these measures, which can be costly. It noted that some companies were forking out S$20,000 to S$30,000 each to implement data protection measures.
Compliance can also be time-consuming. Said ASME President Kurt Wee: “There are rules like - if you don't need the person's data, you have to get rid of it. I'm sure this is a practice that a few will run foul of. People don't think about tracking the information and deleting it on time."
The association plans to hold workshops where firms can get hands-on practice in complying with the Act. The PDPC said the impact on small enterprises would be minimal, if those firms don't process large amounts of personal information.