Prepared for the check-in on 8 January 2027 by the Head of Operations, Quillmarrow’s appointed Data Protection Officer (DPO), with the reviewer’s support.

1. Summary

• The showroom consent-record method went live on 2 December. DA-02 closed before its revised date of 4 December, but after its original target of 13 November.
• The last of the new notices was completed when CCTV signage was installed on 9 December (the job-application notice had been in use since 20 November and the showroom notice since 2 December). DA-04 closed on 9 December, before the revised date of 11 December agreed by the COO.
• The MD approved B8 on 18 December, except for RS-02, RS-12 and RS-13. Advice from Quillmarrow’s accountant and lawyer is awaited before those decisions can be completed.
• The DV-01 data protection addendum remained unsigned at the check-in. Its original target of 15 December was missed; interim data minimisation has applied since 7 December.
• INC-2026-11 was assessed on 11 December. The MD and DPO separately recorded a decision that it was not notifiable; the corrective action is DA-12.
• The COO is asked to confirm revised dates for DA-07 and DA-10. The DPO is asked to approve the C4 review approach; the MD is to be informed of the recorded incident decision and the planned drill.

2. Work done in December

The table records work completed or events occurring during December. Open follow-up is carried in C2 and, where relevant, C3 and C4.

3. Requests and complaints

C3 contains the continuing request and complaint log. The table below covers the three matters received in December; status is shown for the 8 January check-in.

The AR-12 forwarding time follows the arrangement agreed with DV-01 after AR-06. The earlier delay and agreement are tracked under DA-05.

4. Incidents

Facts: INC-2026-11

On 10 December 2026 at 15:05, a Finance officer emailed a B2B customer’s statement of account to a different B2B customer with a similar name. The statement named one sole-proprietor contact, including their name and business mobile number, and listed invoice amounts for that business.

The unintended recipient confirmed deletion in writing on 10 December at 16:30. The Sales Manager told the customer about the incident as a courtesy.

Assessment

The DPO completed the assessment on 11 December 2026 at 11:00. The record identified one individual, no data in the prescribed classes and no significant scale. The assessment is kept separately from the notification decision.

Decision and follow-up

The MD and DPO recorded their separate decision on 11 December 2026 at 14:00: the incident was not notifiable. No notification was made to the PDPC or the individual. The recorded assessment and decision should be retained with the incident evidence; legal questions should be confirmed with a Singapore-qualified lawyer.

DA-12 assigns the IT Manager to implement an external-recipient warning and delayed send for the Finance team’s mail. It is due on 15 January 2027. The MD is to be shown the existing decision record at this check-in; the notification decision has already been made.

5. Vendor and system changes

ShopCloud, DV-02. On 14 December 2026, ShopCloud confirmed in writing that primary hosting is in Singapore and encrypted backups are in Japan, covered by its data processing terms. The B10 transfer note was updated and DA-11 closed. The Japan backup remains an overseas element to document in the transfer review; any legal questions should go to Quillmarrow’s Singapore-qualified lawyer.

Tanjung Contoh Logistics, DV-01. The data protection addendum was not signed by the original target of 15 December. It was sent to DV-01 on 6 January 2027. From 7 December, customer email addresses have not been sent to the partner; the delivery data remains limited to name, delivery address, phone and order lines. This is an interim measure, not a substitute for resolving the addendum. DA-10 is with the COO for a revised date.

NightDesk, DV-04. The Head of Customer Service proposed NightDesk on 14 December for evening and weekend web-shop support. The proposed access covers Helpdesk tickets and chat, and read-only ShopCloud order lookup. Agents would work from Singapore and Manila, so the review needs to address the overseas transfer as well as access and contractual safeguards.

The B9 questionnaire was sent on 17 December and answers were received on 8 January 2027. Their review and the supporting evidence should be recorded in C4 before any pilot proceeds. The proposed AI reply-suggestion feature also needs review; it is not to be assumed approved.

6. Open risks

Ratings below are the check-in view, not a conclusion about legal compliance. C2 carries the action owners and dates.

7. Decisions needed at this check-in

1. COO: Confirm 31 January 2027 as the revised target for the Harbour IT access review, DA-07, and the DV-01 addendum, DA-10. Both original targets have passed.
2. DPO: Approve the approach for the C4 review of DV-04, using B9 and identifying evidence and contract points for Quillmarrow’s lawyer before a pilot proceeds.
3. MD: Receive the already-made INC-2026-11 assessment and separate notification decision record. Note that the tabletop drill is planned for 21 January 2027; the check-in is not being asked to remake the incident decision.

8. Decisions and approvals recorded

Recorded at the check-in on 8 January 2027 (DPO and reviewer; COO joined for decisions):

Report approved by: Head of Operations (DPO), 11 January 2027
Prepared with support from: the reviewer (not the DPO)

9. Next month’s focus

• Complete the Harbour IT administrator access review under DA-07 by the revised date of 31 January 2027.
• Follow up the DV-01 addendum under DA-10, maintaining the interim reduction in data sent while it remains unsigned.
• Obtain accountant and lawyer advice for RS-02, RS-12 and RS-13 and prepare DA-08 for the MD’s decision.
• Review the DV-04 questionnaire and evidence in C4, including the Manila transfer and proposed AI feature; record outstanding conditions.
• Complete DA-12 for Finance mail and run the B11 tabletop drill on 21 January, keeping assessment and decision records separate.
• Maintain suppression of the older showroom sign-ups pending the MD’s decision after lawyer advice, and continue request tracking in C3.