How to Handle a PDPA Access Request: Steps, Deadline and Fees

What a PDPA access request is

Section 21 of the PDPA lets an individual ask an organisation for two things: their personal data in the organisation's possession or under its control, and information about how that data has been or may have been used or disclosed within a year before the request. PDPC's Advisory Guidelines on Key Concepts (chapter on access and correction) explain how to handle both, and PDPC also publishes a short Guide to Handling Access Requests.

A few points that surprise small businesses:

• The person doesn't have to give a reason, though you can ask them to narrow the request (what data, which dates).
• Data held for you by a vendor, such as your booking system or payroll provider, counts as under your control.
• You must give the personal data, not necessarily the whole documents it sits in. You can extract or redact.
• If the person can see the data themselves in an online account you provide, you can tell them how to retrieve it.

How to respond, step by step

Your data protection officer (DPO) normally owns this process. If you haven't appointed one yet, see our guide to appointing a DPO in Singapore.

1. 1

   Log the request and the date received

   The clock starts when you receive the request. Record who asked, what they asked for and how it arrived.

2. 2

   Verify the person's identity

   PDPC expects due diligence but doesn't prescribe a method. Ask for something proportionate, such as confirming account details or contacting them on a number already on file. Keep a record of the check.

3. 3

   Clarify the scope if it is vague

   Ask what kind of data and which period they mean. If they won't narrow it, make a reasonable attempt to respond as completely as possible.

4. 4

   Send a fee estimate if you plan to charge

   Give a written estimate before doing the work. You may refuse to process the request until the person agrees to pay.

5. 5

   Search every system and collect the data

   Use the checklist in the next section. Include vendors who hold data for you.

6. 6

   Check exceptions and mask other people's data

   Remove data about other individuals and anything covered by an exception before release.

7. 7

   Reply in writing

   Provide the data, the use and disclosure information, and explain anything withheld and why.

Where to look for the data

The hardest part is usually finding everything. A personal data inventory, a list of what data you hold and where, makes this much quicker.

For the use and disclosure part, PDPC accepts that you may keep a standard list of the types of third parties you disclose data to, such as payment processors and delivery partners, and provide that list instead of a transaction-by-transaction log.

Fees you can charge for an access request

You may charge a reasonable fee to recover the incremental costs of responding, such as staff time to search and the cost of producing a copy. You can't pass on capital costs like buying new equipment to extract the data.

Before charging, give the person a written estimate. If the final fee will be higher, tell them in writing. PDPC can review a fee on the individual's application and confirm, reduce or disallow it, so keep a note of how you calculated it. Many small businesses simply don't charge for straightforward requests.

When you can refuse or withhold data

Some data you may withhold, under the Fifth Schedule exceptions and section 21. Others you must not release.

If you refuse all or part of a request, you still have to reply. As good practice, PDPC suggests keeping a copy of the withheld data for at least 30 calendar days after rejecting the request, and longer if PDPC takes up a review. This is general information, not legal advice; take advice for disputed or complex requests.

CCTV footage and other people in the record

CCTV requests are common after an incident in a shop, gym or clinic. PDPC's guidance has two practical points.

• Act before the footage is overwritten. If your system keeps footage for 30 days and the request arrives before the deletion date, find and preserve the relevant clip straight away.
• Protect other people. If other customers are identifiable, mask them, or provide a still image instead of video if that meets the person's purpose. A request for all footage of someone over a year may be refused as unreasonable.

Our guide to CCTV and the PDPA in Singapore covers notices, retention and access to recordings in more detail.

Correction requests and your reply

Under section 22, a person can also ask you to correct an error or omission in their data. Unless you have reasonable grounds not to, correct it as soon as practicable and send the corrected data to other organisations you disclosed it to within the year before the correction, if they need it for a legal or business purpose.

A clear written reply to an access request usually covers:

1. the date the request was received and what was searched;
2. the personal data, attached or provided through a secure link;
3. how the data has been or may have been used or disclosed in the past year;
4. anything withheld, with the reason and the exception relied on;
5. the fee charged, if any, and how to contact your DPO with questions.

Send the data securely: a password-protected file with the password sent separately, or a link that only the verified person can open. Our PDPA checklist for small businesses covers the other obligations.

Do it yourself or get help?

One request for one customer's records is something most small businesses can handle in a few hours with this guide. What makes it hard is not knowing where data lives, which is also what makes data breaches hard to assess.

Our PDPA Compliance Pack (S$690) gives you a personal data inventory, a data protection policy, DPO notes and a breach response plan, so the next access request starts from a list instead of a search. It is not legal advice; for a disputed or contentious request, speak to a lawyer.