Why this programme was commissioned

Quillmarrow Supplies Pte. Ltd. (fictional) is an office-supplies distributor with about 80 staff, a Singapore showroom and warehouse, a web shop for individuals and trade accounts for businesses. Malaysia orders are fulfilled by a partner in Johor. Four things made the programme urgent. An enterprise customer's supplier questionnaire asked for a privacy policy, a breach plan and a retention schedule that Quillmarrow did not have. A SharePoint folder of customer returns data was shared with "anyone with the link" for two days in September (INC-2026-07). Marketing planned a telemarketing campaign to SME owners with no Do Not Call (DNC) checks. And the Head of Operations had just been appointed Data Protection Officer (DPO) and needed a working programme to own.

The programme ran remotely over about three to four weeks: interviews with role holders, document review and system walk-throughs using descriptions and masked screenshots. No customer database was received and no client personal data was put into AI tools.

Decisions this supports

• What personal data Quillmarrow needs, why it needs it and where it goes.
• Which gaps need attention first and who owns the action.
• What staff should do when someone withdraws consent, asks for access or correction, or raises a complaint.
• What to check before appointing a vendor or transferring data overseas.
• How the team escalates a suspected breach and records its decisions.
• What management and the appointed DPO need to approve and maintain.

Where each decision is answered

The pack at a glance

These are counts of what the sample documents contain. They are not results or outcomes.

What is in this pack

How to read this pack

1. Start with the gap review (B2): the summary, the three Red areas and the action plan with owners and dates.
2. Read the breach management plan (B11) next. It is the most urgent gap and shows the INC-2026-07 assessment and decision log.
3. Use the inventory (B3) as the reference for every other document: notices, retention, vendors and transfers all point back to its PD IDs.
4. Give staff the policy (B5), the briefing (B15) and the AI-use policy (B14) once the MD approves them.
5. The DPO keeps the programme running from the handover pack (B16).

The breach rule used throughout

A breach is notifiable if it is likely to cause significant harm to the people affected, or affects 500 or more people. Quillmarrow assesses a suspected breach quickly; PDPC guidance expects the assessment within 30 calendar days. If a breach is notifiable, Quillmarrow tells the PDPC as soon as practicable and no later than 3 calendar days after assessing that it is notifiable. Where significant harm is likely, it tells the affected people as soon as practicable, on or after notifying the PDPC. A data intermediary tells Quillmarrow without undue delay. The assessment and the decision to notify are recorded separately. The public explanation is at alexlew.live/faq.html#faq-breach-deadlines.

Approvals and status

The reviewer signs off each deliverable before issue. Quillmarrow's management makes the decisions and the appointed DPO owns the programme after handover.

Limits of this pack

• Facts are client-reported unless a document records the evidence seen.
• Questions that need a legal view, such as the basis for a particular use of data, contract wording or periods set by law, are flagged for a Singapore-qualified lawyer or accountant and are not answered here.
• No forensic investigation, penetration testing or changes to live systems were done.
• Missing evidence is listed, owned and dated in B2 rather than assumed.

After the programme

• Owner. The DPO owns the inventory, the action plan and the maintenance checklist in B16.
• Re-review triggers. A new system, vendor, collection point, overseas flow or marketing channel, a breach or near-miss, or a change in PDPC guidance.
• Cadence. The DPO reports progress on B2 actions to the MD monthly until all Red items close, then reviews the programme annually.