What this pack shows

Quillmarrow Supplies Pte. Ltd. (fictional) is an office-supplies distributor with about 80 staff, a Singapore showroom and warehouse, a web shop and trade accounts. In October 2026 it completed a PDPA programme (the B1 to B16 pack). Its Head of Operations, the appointed Data Protection Officer (DPO), accepted the handover on 2 November 2026 and the Managing Director (MD) acknowledged it the same day.

This pack shows the three months that followed: November 2026, December 2026 and January 2027. The DPO ran the programme. Management made the decisions. The reviewer supported the DPO with a monthly check-in, reviews of drafts and records, and a quarterly report to management. All dates are illustrative.

You appoint your own DPO. I support them. In this pack, every decision and approval is recorded against a Quillmarrow role. The reviewer is never the DPO, is never named as the DPO and does not submit notifications.

Decisions this supports

The pack helps the DPO and management answer five recurring questions. The table shows where each one is answered and which Quillmarrow role decides.

Where each decision is answered

The quarter at a glance

These are counts of what the sample documents contain. They are not results or outcomes.

How to read the RAG ratings. The ratings show progress against the B2 action plan. Green means the planned actions for that area are done and evidenced; it is not a statement that Quillmarrow is compliant.

What is in this pack

Files and formats

The Excel registers hold the same rows as the PDF and Word versions, at the 31 January 2027 snapshot.

Decisions recorded on 12 February 2027

The MD took all five decisions put to the quarterly meeting. C8 section 6 records each decision, who made it and the follow-up it set.

How to read this pack

1. Start with the quarterly report (C8). It is what the MD sees: the RAG view, open risks, the five decisions needed and the decisions made on 12 February 2027.
2. Read one monthly report (C1) to see the rhythm of the service: what was done, what is late, and what was decided at the check-in.
3. Use the action tracker (C2) and the request log (C3) as the working records behind both reports.
4. Read the vendor review (C4) and the breach drill (C7) to see how a new vendor and a suspected breach are handled, with decisions kept with Quillmarrow.
5. The change log (C5) and the refresher (C6) show how changes reach staff.

How the monthly rhythm works

What ran late

Open risks and what happens next

Three areas stayed Amber at 31 January 2027. Each has an owner and a dated next step.

Other next-quarter work: DV-04 conditions confirmed before 1 March 2027 (DA-13), refresher catch-ups by 26 February 2027 (DA-15), the RS-10 visitor-log clean-up by 28 February 2027 (DA-09), planning the annual policy review, and the next breach drill in July 2027. Check-ins are planned for 5 March and 2 April 2027.

Reference IDs used in this pack

Roles

The breach rule used throughout

A breach is notifiable if it is likely to cause significant harm to the people affected, or affects 500 or more people. Quillmarrow assesses a suspected breach quickly and records when the assessment was completed. If a breach is notifiable, Quillmarrow tells the PDPC as soon as practicable and no later than 3 calendar days after assessing that it is notifiable. Where significant harm is likely, it tells the affected people as soon as practicable, on or after notifying the PDPC. A data intermediary tells Quillmarrow without undue delay. The assessment and the decision to notify are recorded separately. The public explanation is at alexlew.live/faq.html#faq-breach-deadlines.

Approvals and status

The reviewer reviews and signs off each deliverable before issue as a quality check. Quillmarrow's DPO and management make every decision and approval.

Limits of this pack

• The pack includes one monthly report (December 2026, C1) as the worked example. The November and January reports used the same format and are summarised in C8 rather than reproduced. The January figures are the 31 January 2027 snapshot in C2, C3 and C8.
• Facts are client-reported unless a document records the evidence seen.
• Questions that need a legal view, such as contract wording, transfer safeguards or periods set by law, went to Quillmarrow's own lawyer or accountant and are not answered here.
• The support did not include an emergency hotline, forensic work, penetration testing or changes to live systems.
• Missing evidence is listed, owned and dated in C2 rather than assumed.

References

These are the guidance documents the pack works from. No section, regulation or paragraph numbers are quoted.

• Personal Data Protection Act 2012 (PDPA).
• Personal Data Protection (Notification of Data Breaches) Regulations 2021.
• PDPC Advisory Guidelines on Key Concepts in the PDPA.
• PDPC Guide on Managing and Notifying Data Breaches under the PDPA (C.A.R.E.: Contain, Assess, Report, Evaluate).
• PDPC Advisory Guidelines on the Do Not Call Provisions.
• ASEAN Model Contractual Clauses, mentioned as one option for transfer safeguards.

Version and sign-off