Organisation	Quillmarrow Supplies Pte. Ltd. (fictional)
Document	C6 · Staff refresher: session outline and attendance
Version	1.0
Date	26 January 2027 (illustrative)
Prepared by	Alex Lew, reviewer and sign-off
Client approver (role)	Head of Operations (DPO) with the HR Manager
Label	Fictional organisation, illustrative only, not a client case study

1. Purpose and audience

This refresher is for all Quillmarrow staff. It reinforces three practical habits: report a suspected personal data incident immediately, pass requests to the right person promptly, and share customer information only through approved arrangements.

The session was held remotely on Teams on 26 January 2027, in two slots at 10:00 and 16:00. The DPO, who is the Head of Operations, ran it with the HR Manager. The reviewer prepared the outline and scenarios.

The examples draw on INC-2026-11, AR-13 and the proposed DV-04 pilot. The breach drill is simulated. Staff are not expected to decide whether an incident is notifiable or to interpret the law. Raise uncertain situations with the DPO.

2. Agenda

Minutes	Topic	Lead	Key message
0–3	Welcome and purpose	DPO	Recognise a concern and pass it on promptly.
3–8	Misdirected email: INC-2026-11	DPO	Report immediately; do not conceal or investigate alone.
8–13	Correction request: AR-13	HR Manager	A request in a shared mailbox must reach the DPO promptly.
13–18	Proposed evening support: DV-04	DPO	The pilot is not live; access is conditional and limited.
18–23	Simulated breach drill	DPO	Staff report; the DPO leads the assessment; management decides separately.
23–28	Five-question check	HR Manager	Check that staff know the practical next steps.
28–30	Questions and close	DPO	Ask when unsure and use the DPO contact.

Total: 30 minutes.

3. Scenarios

Scenario 1: A statement sent to the wrong customer

A Finance officer sends a statement of account to a B2B customer with a similar name to the intended recipient. The statement contains a sole-proprietor contact’s name and business mobile number, as well as that business’s invoice amounts. The officer notices the mistake after sending it.

What would you do?

Expected answer: Tell the DPO immediately and provide the facts known so far: when the email was sent, who received it, what was attached or included, and what personal data may be involved. Keep the original email and any relevant correspondence. Follow the DPO’s instructions on containment; do not try to hide the mistake, delete the evidence or decide for yourself that it is too small to report.

Do not contact the recipient or the affected customer yourself. The DPO coordinates the response and determines who should take any further steps.

In INC-2026-11, the recipient confirmed deletion in writing on 10 December 2026. The DPO completed the assessment on 11 December, and the MD and DPO recorded a separate decision that the incident was not notifiable. The Sales Manager told the customer as a courtesy. The lesson led to DA-12: an external-recipient warning and delayed send for the Finance team’s mail.

Scenario 2: A correction request in a shared mailbox

A B2B contact emails a shared sales mailbox to say that their email address is wrong and asks for it to be corrected. The message is mixed in with routine sales enquiries.

What would you do?

Expected answer: Forward the request-like email promptly to the DPO under the shared-mailbox forwarding rule. Preserve the message and its receipt date, and follow the DPO’s or Sales Manager’s instructions for checking and making the correction. Do not leave it in the mailbox until the next routine review, and do not assume that correcting one system updates every relevant system.

AR-13 was received on 5 January 2027 and acknowledged on 12 January, late against Quillmarrow’s three-working-day acknowledgement target. The address was corrected in ShopCloud and MailBurst on 12 January; the response was on target. The lesson was to forward request-like messages from shared mailboxes to the DPO. B7 sets out the procedure; C3 records the request.

If the request is unclear, pass on what was received rather than guessing what the person wants. The DPO can coordinate any necessary clarification.

Scenario 3: A question about evening chat

A customer asks whether the new evening chat team can see their orders. The customer has heard that Quillmarrow is considering outside support.

What would you do?

Expected answer: Explain that the proposed DV-04 pilot is not live yet. Do not say that the new team already has access or promise that the pilot will start. Refer a question you cannot answer to the DPO or Head of Customer Service.

The proposed arrangement is for DV-04 agents to handle Helpdesk tickets and chat and have read-only order lookup in ShopCloud. Agents would work from Singapore and Manila. The DPO’s decision to proceed with a three-month pilot from 1 March 2027 is conditional: the DA-13 requirements must be met before it starts. These include limited access roles and keeping AI reply suggestions off. C4 records the review and conditions.

Staff must not grant access themselves or enable the AI feature. If asked about details of the proposed arrangement, refer the question rather than making an assurance that has not been confirmed.

4. Five-minute breach-drill script

This is a simulation. No incident is being reported through this exercise.

Minute 1 — DPO reads:

“A colleague tells you that an email containing customer information may have gone to the wrong recipient. The colleague is unsure what the recipient has opened. What is your first step, and who do you tell?”

Invite staff to answer. Confirm: tell the DPO immediately, even if the facts are incomplete. Give the time and details known so far. Do not wait for proof that harm has occurred.

Minute 2 — DPO reads:

“What should you avoid doing while the DPO coordinates the response?”

Expected points: do not delete the email or other evidence, conceal the error, investigate on your own, speculate about the outcome, or contact the PDPC or customers yourself. Follow the DPO’s instructions on safe containment. Preserve relevant records and do not circulate the personal data more widely than necessary.

Minute 3 — DPO reads:

“What information would help the DPO open the incident record?”

Expected points: when the concern was discovered and reported; what happened; the systems or records involved; what personal data and people may be affected; the recipient or possible exposure, if known; and any containment already carried out. Record what is known and distinguish it from what still needs checking. Keep relevant evidence, such as the original message and subsequent correspondence.

Minute 4 — DPO reads:

“Who assesses the incident, and who decides whether to notify?”

The DPO leads the assessment, recording the facts, scale and potential harm. The MD and DPO make and record the notification decision separately, including its timing and reasons. Staff supply information and follow instructions; they do not make the notification decision.

Minute 5 — DPO reads:

“If an incident is assessed as notifiable, what timing must be remembered?”

If notifiable, notify the PDPC as soon as practicable and no later than 3 calendar days after assessing that the breach is notifiable.

The DPO coordinates the response under B11. Staff must not contact the PDPC or customers themselves. Questions about legal requirements should be referred to a Singapore-qualified lawyer. Close by reminding staff to report immediately rather than waiting for a complete account.

5. Five-question check

1. You realise that customer information may have been emailed to the wrong recipient. What do you do first?
   Answer: Tell the DPO immediately, share the facts known so far and preserve the email and other relevant evidence.

2. A correction request arrives in a shared mailbox. Where should it go?
   Answer: Forward it promptly to the DPO under the shared-mailbox rule; keep the receipt date and follow B7.

3. Can the proposed DV-04 team use AI reply suggestions during the conditional pilot?
   Answer: No. The feature must remain off under the pilot conditions. The pilot is not live at the time of this refresher.

4. Who leads the breach assessment, and who makes the separate notification decision?
   Answer: The DPO leads the assessment. The MD and DPO make and record the notification decision separately.

5. Should a staff member contact the PDPC or a customer about a suspected breach?
   Answer: No. Staff report to the DPO and follow instructions; they do not contact the PDPC or customers themselves.

6. Attendance and follow-up

For the 26 January 2027 refresher, 79 staff were invited, 71 attended and 8 were absent. The absences were mostly among warehouse night-shift staff and staff on leave. Under DA-15, the HR Manager owns the follow-up: the eight staff are to complete the recorded session and five-question check by 26 February 2027. DA-15 is Open and on track at 31 January 2027.

The earlier B15 briefing was held on 3 and 10 December 2026. 74 of 80 staff attended; 5 absentees completed the recording by 22 December 2026, and 1 was on long-term leave.

The attendance record by team follows.

Attendance record by team, 26 January 2027

Team	Invited	10:00	16:00	Attended	Absent	Reason	Catch-up	Team lead
Management and administration	10	6	4	10	0	None	Not needed	COO
Customer Service	10	5	5	10	0	None	Not needed	Head of Customer Service
Sales	8	4	3	7	1	Annual leave	Recorded session and 5-question check by 26 Feb 2027	Sales Manager
Marketing	6	3	3	6	0	None	Not needed	Head of Marketing
Finance	6	3	2	5	1	Annual leave	Recorded session and 5-question check by 26 Feb 2027	Finance Director
HR	4	2	2	4	0	None	Not needed	HR Manager
IT	5	3	2	5	0	None	Not needed	IT Manager
Warehouse (day shift)	12	6	5	11	1	Annual leave	Recorded session and 5-question check by 26 Feb 2027	Warehouse Manager
Warehouse (night shift)	10	1	5	6	4	Night shift (3), annual leave (1)	Recorded session and 5-question check by 26 Feb 2027	Warehouse Manager
Showroom	8	4	3	7	1	Annual leave	Recorded session and 5-question check by 26 Feb 2027	Showroom Supervisor
Total	79	37	34	71	8		DA-15, HR Manager

Counts by team only; the named register is kept by the HR Manager in Fictional PeopleDesk. Retention under B8 (training records to confirm).