Organisation	Quillmarrow Supplies Pte. Ltd. (fictional)
Document	B7 · Access and correction procedure and log
Version	1.0
Date	30 October 2026 (illustrative)
Prepared by	Alex Lew, reviewer and sign-off
Client approver (role)	Head of Operations (DPO)
Label	Fictional organisation, illustrative only, not a client case study

1. Scope and who handles requests

This procedure covers requests by individuals to access or correct their personal data held by Quillmarrow. Requests may arrive by email, telephone, post, in person or through a service provider. A person does not need to use a particular form or refer to the PDPA for staff to recognise a request.

Customer Service handles customer and general intake. HR handles staff and job-applicant intake. Either team must forward the request promptly to the Head of Operations, Quillmarrow’s appointed Data Protection Officer (DPO), who coordinates the search and decides the response. The DPO may involve the IT Manager, system owners, relevant department heads and a Singapore-qualified lawyer.

The B7 sample log covers AR-01 to AR-06. The log is illustrative; it is not evidence that Quillmarrow has received or completed those requests. The current gap, G-05, is that requests have been handled ad hoc and no log was reported.

2. Procedure

1. Receive the request. Note what the person is asking for, when it was received and how to contact them. If a provider receives it, ask the provider to forward it promptly. For example, AR-06 concerns a request received by DV-01, Tanjung Contoh Logistics Sdn. Bhd. Do not tell the person to start again solely because the request came through a partner.

2. Open a log entry. Assign a request reference and record the date received, request type, responsible owner and target dates. Store the request securely. Forward it to the DPO and the appropriate Customer Service or HR contact.

3. Verify identity proportionately. Use information already held or an approved account verification method where suitable. Ask only for what is reasonably needed to establish that the requester is the individual concerned, or is authorised to act for them. Do not routinely ask for an NRIC or FIN copy. Record the verification method and outcome without keeping unnecessary identity evidence.

4. Acknowledge. Aim to acknowledge within three working days of receipt. Confirm the request’s scope in plain language. If it is unclear, ask a focused question while continuing with any part that is clear. Explain the next steps without promising an outcome before the DPO has reviewed the records.

5. Locate the information. Use the B3 inventory to identify relevant systems and owners. Depending on the request, searches may involve Fictional ShopCloud, Microsoft 365, Fictional Helpdesk, Fictional PeopleDesk, paper records or a provider. Record where searches were made, who conducted them and any systems or periods that could not be checked. Request only the information needed for the search.

6. Review the proposed response. The DPO determines what information falls within the request, checks the search results and considers whether any information needs further review. Where another person appears in a record, consider masking their information or using another appropriate method. For AR-04, showroom CCTV may show third parties; the Showroom Supervisor and IT Manager should help identify and preserve relevant footage while the DPO reviews the response.

7. Check any proposed exception. Do not withhold information merely because it is inconvenient or because a record mentions another person. If Quillmarrow proposes to rely on an exception or otherwise limit a response, the DPO should consult a Singapore-qualified lawyer and record the basis and decision. Check how much can appropriately be provided after masking or other measures.

8. Correct information where appropriate. For a correction request, check the information with the relevant record owner and record the change in the appropriate system. Check which organisations the information was disclosed to and whether the corrected data should be sent to them; the look-back period and any exceptions should be confirmed with a Singapore-qualified lawyer. Keep a record of recipients contacted and the result. If the correction is disputed or not made, the DPO should record the reason and confirm the response with legal advice where needed.

9. Approve and respond. The DPO approves the response and checks the recipient, attachments and delivery method. Send records securely using an agreed method appropriate to their sensitivity. Do not send an unprotected file or unrestricted sharing link without considering the risk. Tell the person what has been provided or corrected and whom to contact with questions.

10. Close and retain the log entry. Record the response date, outcome, any organisations informed of a correction, evidence location and outstanding follow-up. The DPO checks that the response and evidence are complete before closing the entry. Retain request records under RS-16 once Quillmarrow has confirmed the B8 retention decision.

If a request reveals a suspected data breach, report it immediately to the DPO and follow B11. Continue handling the request separately; opening an incident record does not close the request.

3. Timelines and extensions

Quillmarrow’s proposed operating targets are:

• Acknowledge within three working days of receipt.
• Respond within 30 days (Quillmarrow’s own target), while aiming to respond as soon as reasonably possible rather than waiting for the target date.

These are organisation targets, consistent with the expectation to respond as soon as reasonably possible. The DPO should confirm the applicable legal requirements with a Singapore-qualified lawyer.

Start tracking from the date the request is received, including when it is first received by a relevant intake team or forwarded from a partner. Assign an owner and monitor progress during identity checks, searches and review. Do not wait until the end of the target period to identify a delay.

If more time is needed, the DPO should tell the person in writing within 30 days when a response will be given, and record the reason, communication and revised date. Confirm the approach with a lawyer. Continue working towards the response and update the person if the revised date is at risk.

The gap review found that one request took 41 days with no log. The sample log shows it as AR-02, a former employee’s request for an HR file that came in through Customer Service, not HR. It was acknowledged in two days but then waited for the HR search, and no extension notice was sent. Under this procedure the request would have been logged on the day it arrived, routed to HR the same day, and flagged at the monthly review or earlier so that the DPO could write to the person before the 30-day target passed.

4. Fees

The proposal for MD approval is that Quillmarrow does not charge for routine access or correction requests. Correction requests are not charged. Staff must not ask for payment for a routine request. If an unusual request raises a question about charges, refer it to the DPO for review and confirmation with a Singapore-qualified lawyer before making any proposal to the requester.

5. Draft response templates

The DPO should adapt and approve each response. Complete the placeholders and check that the wording matches the actual request and action taken.

Acknowledgement

Subject: Your personal data request

Dear [name],

We received your request on [date]. You have asked us to [brief description].

We will review the request and contact you if we need information to confirm your identity or clarify its scope. We aim to respond as soon as reasonably possible. If we need more time, we will let you know in writing when we expect to respond.

For questions, contact our Data Protection Officer at dpo@quillmarrow.example.

Response with data enclosed

Subject: Response to your personal data request

Dear [name],

We refer to your request received on [date]. We have enclosed [description of the information provided] using [secure delivery method].

[Explain any relevant limits, masking or separate delivery, as approved by the DPO.]

If you have questions about this response, please contact our Data Protection Officer at dpo@quillmarrow.example.

Correction confirmation

Subject: Confirmation of correction

Dear [name],

We refer to your request received on [date]. We have corrected [description of the information] in [relevant record or system].

[Where applicable: We have also sent the corrected information to the relevant organisations identified in our review. / We are completing the following action: details and expected date.]

If you have questions, please contact our Data Protection Officer at dpo@quillmarrow.example.

6. Log fields and monthly review

Each B7 log entry should include:

• Request ID, receipt date, channel and intake owner.
• Requester reference, contact route and identity-verification status.
• Request type, scope and any clarification received.
• Acknowledgement date, response target and assigned search owners.
• Systems searched, relevant providers, search dates and evidence location.
• DPO decision, legal review where relevant, masking or other limitations.
• Correction made, organisations considered or contacted, and outstanding actions.
• Extension notice and revised date, if applicable.
• Response date, delivery method, outcome, closure date and DPO approval.

The DPO should review the log monthly for overdue requests, approaching targets, missing evidence, recurring issues and follow-up actions. Report material delays to the COO and record improvement actions in B2 under G-05. Access to the log and supporting records should be limited to those who need it.

7. What the sample log shows

Request	Point to learn	Action
AR-02	An HR request arrived at Customer Service and stalled in the HR search; 41 days, no extension notice.	Route HR requests to HR on day one; DPO writes to the person before day 30 if a delay is likely (G-05).
AR-04	CCTV footage shows other customers.	Preserve the footage first (RS-09 overwrite risk), then mask third parties before release.
AR-05	The disclosure question needs the vendor list.	Answer from B3 "shared with" and B9 vendor records, not from memory.
AR-06	The request reached the Malaysia partner first.	Start the clock from when Quillmarrow is told; ask DV-01 to forward requests within one working day and record its receipt date (B9 question).
AR-01, AR-03	Routine requests closed within target.	Keep the evidence of the identity check and of the systems searched.

8. Roles and approval

Role	Responsibility
Head of Operations, appointed DPO	Owns this procedure and the log; approves every response.
Head of Customer Service	Customer intake; first search of Fictional ShopCloud and Fictional Helpdesk.
HR Manager	Staff and applicant intake; search of Fictional PeopleDesk and HR files.
IT Manager	Searches of Microsoft 365 and logs; CCTV preservation with the Showroom Supervisor.
Managing Director	Approves the no-fee proposal and any change to the targets.

This procedure is practical operating support for Quillmarrow and is not legal advice. The sample log for AR-01 to AR-06 follows.

Sample request log (AR-01 to AR-06)

ID	Received	Channel	Requester	Request	ID check	Acknowledged	Decision	Responded	Days	On target	Approved by	Notes
AR-01	4 Aug 2026	Fictional Helpdesk web form	Web-shop customer	Copy of order history and marketing data.	Matched the request to the account email and completed the account verification process; retain evidence of the check.	5 Aug 2026	provide — order history and marketing data located	18 Aug 2026	14	Yes	Head of Operations (DPO); prepared by Head of Customer Service	Illustrative sample entry. Record the systems searched and response delivery method in the request file.
AR-02	10 Aug 2026	Email to Customer Service	Former employee	Copy of their HR file.	Verified using the former employee contact details already held and an additional identity check; retain evidence of the check.	12 Aug 2026	provide in part — third-party information removed	20 Sep 2026	41	No	Head of Operations (DPO)	Illustrative sample entry for the 41-day case under G-05. Received by Customer Service; HR search not started until late; no extension notice sent. Record the delay reason and improvement; confirm any exception relied on with a lawyer.
AR-03	20 Aug 2026	Email to Sales	B2B account contact	Correct job title and email address.	Confirmed the request using the existing business contact channel and checked the updated details with the requester.	21 Aug 2026	correct — job title and email updated	25 Aug 2026	5	Yes	Head of Operations (DPO); prepared by Sales Manager	Illustrative sample entry. Record the systems updated and confirm the correction was reflected in relevant account records.
AR-04	1 Sep 2026	In person at the showroom	Showroom customer	Copy of CCTV footage showing them at the showroom.	Verified the requester's identity in person and recorded the check without retaining unnecessary identity-document details.	2 Sep 2026	provide in part — third-party data masked	12 Sep 2026	11	Yes	Head of Operations (DPO); prepared by Showroom Supervisor	Illustrative sample entry. Record the footage search, review and masking steps; confirm any exception relied on with a lawyer.
AR-05	14 Sep 2026	Fictional Helpdesk web form	Web-shop customer	Information about organisations to which their data was disclosed in the past year.	Matched the request to the customer account and completed the account verification process; retain evidence of the check.	15 Sep 2026	provide — identified disclosures and searched relevant records	1 Oct 2026	17	Yes	Head of Operations (DPO)	Illustrative sample entry. Keep the search record and list the relevant recipients; confirm any exception relied on with a lawyer.
AR-06	5 Oct 2026	Email forwarded by Tanjung Contoh Logistics Sdn. Bhd. (DV-01)	Customer whose request was received by the Malaysia partner	Access or correction request forwarded by DV-01; exact wording and scope to be confirmed with the requester.	Not yet completed; confirm identity directly with the requester using an appropriate channel.	6 Oct 2026	Open — confirm request scope and identity before deciding	Open	Open	Open	Head of Operations (DPO)	Illustrative sample entry. Record when DV-01 received and forwarded the request, confirm its date of receipt with Quillmarrow, and follow up under the AR-06 process and G-05.