|
SERVICES › SAMPLES › PDPA PROGRAMME
PDPA programme: full worked example
AI and data governance from someone who builds the controls, not just the policies. This is a complete PDPA programme, end to end, for one invented company: Quillmarrow Supplies Pte. Ltd. (fictional), an office-supplies distributor and online store with about 80 staff, a showroom and a Malaysia fulfilment partner. It shows the gap review, the data inventory and flow map, the notices, policy and procedures, the retention schedule, the vendor and transfer checks, the breach plan and the DPO handover you would receive, in about three to four weeks.
Fictional organisation, illustrative only, not a client case study « All sample previews | About the PDPA programme
|
|
| The situation |
|
Quillmarrow Supplies Pte. Ltd. (fictional) is an office-supplies distributor with about 80 staff, a Singapore showroom and warehouse, a web shop for individuals and trade accounts for businesses. Malaysia orders are fulfilled by a partner in Johor. Four things made the programme urgent. An enterprise customer's supplier questionnaire asked for a privacy policy, a breach plan and a retention schedule that Quillmarrow did not have. A SharePoint folder of customer returns data was shared with "anyone with the link" for two days in September (INC-2026-07). Marketing planned a telemarketing campaign to SME owners with no Do Not Call (DNC) checks. And the Head of Operations had just been appointed Data Protection Officer (DPO) and needed a working programme to own. The programme ran remotely over about three to four weeks: interviews with role holders, document review and system walk-throughs using descriptions and masked screenshots. No customer database was received and no client personal data was put into AI tools.
|
|
|
|
| Everything in the pack |
|
Download the whole pack as a ZIP Every file carries the label "Fictional organisation, illustrative only, not a client case study", a version, a date, the preparer and the client approver role.
|
|
|
|
| Breach facts |
|
The breach rule used in this pack. A breach is notifiable if it is likely to cause significant harm to the people affected, or affects 500 or more people. If it is notifiable, tell the PDPC as soon as practicable and no later than 3 calendar days after assessing that it is notifiable. The assessment is recorded separately from the decision to notify. The FAQ explains the triggers and deadlines.
|
|
| About this worked example |
|
Prepared by Alex Lew (CFA, AIGP, CIPP/A, FIP). I personally review and sign off every deliverable. The templates behind these documents are in the AI governance and PDPA toolkit: complete and available now; one organisation, internal use, 12 months of updates. DM @alewyl1 on X, pay, then the ZIP arrives by email. This is practical compliance support, not legal advice. For legal advice, use a Singapore-qualified lawyer. You appoint your own DPO. I support them. Want this for your business? DM @alewyl1 on X, or ask for a free intro call (coffee chat).
|
|
|
|