Chapter 10: Data Protection Management Programme (DPMP)

A program that establishes and maintains an organization's practices for protecting personal data.

Regularly examining an organization's data protection policies and practices to identify and address any gaps or vulnerabilities.

The ongoing monitoring and assessment of changes in laws and regulations related to data protection. This includes keeping track of new laws, amendments, and interpretations.

Monitoring changes within the organization that could impact data protection practices. This includes internal policy updates, technology advancements, and changes in business processes.

A designated individual within an organization who is responsible for overseeing the implementation and maintenance of the DPMP.

Regularly reviewing and updating the DPMP to ensure it remains consistent with evolving regulations, technology, and organizational changes.

Ensuring that the DPMP is aligned with the organization's actual practices and effectively manages data protection risks. This involves validating and confirming the effectiveness of data protection policies and practices.

Incorporating clauses into employment contracts that clearly state the responsibilities of the employer in protecting employee personal data.

Providing guidance to employees on how to handle and protect personal data in the workplace.

Clearly outlining the responsibilities of vendors in handling and disposing of personal data they access through a business agreement.

Using standard clauses in contracts to ensure that vendors comply with data protection requirements.

Regularly reviewing and updating the data protection clauses in third party agreements.

Setting specific requirements on how vendors must manage and dispose of personal data they receive from a company.

Using contracts and agreements with vendors to ensure they dispose of personal data securely and responsibly when it is no longer needed.

Incorporating data protection clauses into contracts that clearly state the responsibilities of the company and vendors in handling, managing, and disposing of personal data.

Ensuring that all data protection clauses in agreements with vendors are clearly written and understandable. It is important that all parties involved are aware of their responsibilities.

Regularly monitoring vendor contracts and activities to ensure they are adhering to the required data protection standards.

The DPO should stay informed about any changes in the organization's systems or processes which collect, use, disclose or store personal data.

A DPO should be aware of any new business ventures that the organization is entering into or considering.

A DPO should maintain a record of any data protection breaches that the organization experiences.

The DPO should consider feedback from stakeholders, for example, instructions from management and feedback from customers, to stay informed.

Conducting staff surveys to understand the organization's personal data protection awareness and practices can help the DPO stay informed.

Conducting Data Protection Impact Assessments (DPIAs) on newly designed or significantly altered systems and processes that collect, use, disclose or store personal data can aid in keeping the DPO informed.

The DPO should attend to feedback from stakeholders, such as from customers.

When changes occur in the external or internal environment, organizations may need to update their personal data protection policies and practices (Standard Operating Procedures).

It is crucial for both internal staff and third-party organizations handling data on behalf of the organization to understand the organization's data handling and protection expectations.

An audit of an organization's data protection practices to ensure compliance with legal requirements and best practices.

A review to assess if the company's policies and practices align with legal obligations and the organization's own data protection standards.

This involves evaluating the company's data protection practices for effectiveness, including staff awareness, training programs, and new employee onboarding processes.

The Data Protection Officer (DPO) reports findings from data protection assessments to management.

Regular communication from the DPO to management helps ensure support and alignment for data protection efforts. This includes both positive outcomes and any potential risks.

Making sure third-party companies accessing your organization's data are who they claim to be.

Agreements in place for transferring personal data across borders, like sending information outside Singapore. These agreements ensure the data remains protected.

Checking the policies, practices, and procedures of potential vendors or third-party companies to ensure they handle personal data securely.

Regularly examining and updating contracts with third-party companies to confirm they're still adhering to data protection standards.

A detailed assessment that helps identify, analyze, and address potential risks to personal data when implementing new changes or processes within an organization.

Ensuring that agreements made with third-party organizations regarding data transfer are consistent with the rules of the receiving country.

The process of regularly evaluating and updating the organization's data protection policies and practices to address any gaps or vulnerabilities.

Monitoring changes both inside and outside the organization that could impact data protection practices.