MODULE 1: PERSONAL DATA PROTECTION CHALLENGES AT THE WORKPLACE

• Introducing PDPA 2010
  
• The main Ingredients of PDPA 2010
  
• Understanding Section 6 and Consent
  
• Forms of Consent -Implicit/Validity/Explicit and how to be compliant
• Managing Consent -How to obtain/Who consents/The process and compliance
  
• Sensitive Personal data and consent
  
• Personal Data and Cloud computing
  
• Guidelines on understanding Purpose under Section 6 PDPA 2010.

MODULE 2: TRANSPARENCY OF DATA HANDLING AND THE RIGHT TO BE FORGOTTEN

• Primary duties of Data User under Section 7 PDPA 2010
  
• Data User subject to Audit and Inspection
  
• Due Diligence and role of Data User
  
• Statutory duties of Data User under PDPA 2010
  
• When must Notice be given
  
• Elements for Notice S.7 Compliance – How to collect / Means of sources / Disclosure to Third parties and rights of Data Subject
  
• Channels of communication – Best practice

MODULE 3: UNDERSTANDING S.10, / S.11 / S.12 ISSUES AND IMPLICATIONS OF THE PRINCIPLE

• Disclosure Principle and guidelines on when you can refuse to disclose or partially disclose;
  
• Guidelines and understanding the Retention Principle and how it relates to Employees and former employees;
  
• Guidelines on Disposal of Records as per Retention Principle- Reasons for destruction/Destruction Methods/ documentation for disposal/Checklist
  
• Guidelines and understanding the Data Integrity Principle under S.11;
  
• S.11 possible offences committed by companies and understanding of incorrect, not accurate, not up-to date data and inaccuracy and the relation of rights of individuals under Section 12 to counter Section 11 offences.
  
• Access Principle under S.12 and guidelines on how and when to grant excess to access requests.
  
• Guideline on requestor access request

A discussion on how the principles will be used in the compliance system of the company.

MODULE 4: SECURITY GUIDANCE AND PRIVACY IMPACT ASSESSMENT

This module looks at what constitutes a Personal data security breach and how such breaches can occur. It also considers how to avoid breaches, and the practical steps that should be taken when a breach occurs.

Key aspects of this module include:

• Analysis of the Security Principle under Section 9 PDPA
  
• How security principle used in relation to Nature of Data / Location / Third Party Outsourcing / Measures
  
• Do’s and Don’ts of Data Security and Common Breaches as highlighted by MCMC / PDP office.
  
• Data Security Standard -Implementation and Compliance
  
• Assessing Risks and Impact
  
• Compliance with Inspection Requirements

OVERVIEW ON PDPA UNDERSTANDING AND IMPLEMENTING PDPA ESSENTIALS AT THE WORKPLACE.

• This will include must have documentation for compliance
  
• The policies that cover the Principles under PDPA
  
• Other aspects of PDPA implementation at the workplace.

MODULE 5: COMPLIANCE FOR DEPARTMENTS AND PDPA PRINCIPLES FOR HUMAN RESOURCES DEPARTMENTS

Meeting the requirements of data protection law can be particularly challenging. Holding and handling staff information carries significant legal responsibilities and risks. This module discusses key areas of compliance.

• Ensuring that the recruitment and selection process meets legal requirements, including the content of application forms, pre-employment vetting, criminal records, medical checks and the interview process
  
• Retaining staff records, and appropriate periods of time for keeping information
  
• Dealing with staff information requests – what must be disclosed and can be withheld
  
• Disclosing staff information to outside third parties –the legal requirements that must be met before staff information can be sent outside the organisation
  
• References and the rights of ex-members of staff
  
• Monitoring staff activities and communication including using Managers, CCTV cameras and website technologies
  
• Outsourcing functions to third party providers
  
• Provisions to be included in Third Party Contracts as required by the 2015 Standards.

MODULE 6: COMMISSIONER AND UNDERSTANDING POWERS UNDER S.104 TO S.109 PDPA 2010

• Powers of Investigations by PDP Officers
  
• Penalties for Obstruction and search / seizure of data
  
• Criminal Offences and Liabilities under the PDPA 2010
  
• Punishment for contravention of the Act
  
• Offences by body corporate
  
• Contravention of the personal data protection principles
  
• Processing of sensitive personal data in contravention to Section 40
  
• Unlawful collection or disclosure of personal data
  
• Personal Data Protection (Compounding of Offences) Regulations 2016

MODULE 7: COMPLIANCE FOR SECTION 6 & 7 [PARTICIPANT TO USE OWN DOCUMENTS FOR AUDIT FOR COMPLIANCE] AND PROCEDURES AND POLICIES BASED ON THE 7 PRINCIPLES FOR THE WORKPLACE.

• Discussion on Drafting the Consent Notice for various categories of Business sectors
  
• Discussion on Drafting Consent Notice for Application forms/ Interview forms/ Confidentiality clauses on consent etc.
  
• Drafting the Notice and understanding how to draft the purpose clause in the Notice
  
• Guidelines on different categories of Notices

MODULE 8: COMPLIANCE FOR THE PERSONAL DATA PROTECTION STANDARDS 2015 [MANDATORY]

• The Data Security Standard distinguishes between conventional and electronic data management and prescribes various security measures in relation to each.
  
• Data Retention Standard
  
• Data Storage Standards
  
• Data Integrity Standard
  
• Data Security Standard

[Participants encouraged to discuss their organization compliance audit as part of this module]

MODULE 9: PDPA AND COVID-19

• What type of personal data is typically being processed during the Covid-19 outbreak?
  
• May employers collect information about travel history of employees, contractors and visitors?
• May employers request employees, contractors or visitors to notify them if the latter is diagnosed?
  
• May employers notify others of any employee, contractor or visitor who is infected or suspected of being infected?
  
• Purpose under PDPA and Prevention and Control of Infectious Diseases Act 2020