Chapter 7: Personal Data Protection Policy Guidelines

Next Steps to Developing the Data Protection Management Programme (DPMP)

• Key takeaways from this chapter are understanding how an organization: -Develops a data protection policy and designates data protection roles and responsibilities. -Designs processes to operationalize policy.

Develop Policy - The Policy Lifecycle

• An organization's governance and risk management structure shapes its data protection policies and practices.
• The organization should develop appropriate data protection policy and practices and communicate them to internal and external stakeholders.
• The policy lifecycle has four steps: -Drafting, reviewing, revising -Obtaining management approval -Communicating to stakeholders -Training and enforcing the policy.
• The Data Protection Officer (DPO) should draft the personal data protection policy with input from the PDPA Project Team and senior management.
• The PDPA policy should define what the organization needs to do to comply with the PDPA and identify areas and risks covered by the policy.
• Policies and practices should include consent clauses, notification of purpose, and a Consent Registry.
• Policies and practices should address access, correction, data portability, requests, complaints, and other queries.
• An 'Acceptable Use Policy' or 'Fair Use Policy' outlines constraints on employee access to the organization's IT network or internet.
• 'Bring Your Own Device' (BYOD) policies govern circumstances in which employees connect their own devices to the company network.
• Standard operating procedures govern the collection, use, disclosure, and storage of personal data.
• Due diligence should be exercised when engaging data intermediaries and contracts must include data protection clauses.
• Non-disclosure/confidentiality agreements with parties sharing personal data, an IT policy, and an information security policy, are essential.
• A data/document retention policy and personal data protection notices are also necessary, and organisations should refer to the International Association of Privacy Professionals (IAPP) Certified Information Privacy Manager (CIPM) program.

Develop Policy - Internal Data Protection Policies and Practices

• A personal data protection policy is a statement outlining data handling practices for employees and defining policies and procedures.
• The policy and procedures should be practical, easy to understand, and in line with each other.
• Organizations must ensure their policies comply with the (PDPA), based on the Accountability Obligation.
• The personal data protection policy establishes tone and guidance for personal data handling, clearly defining the responsibilities of employees. The policy must be 'owned' by someone within the company (e.g., an HR department).
• Organisations should be clear on their internal ownership of data protection notices and policies.
• Organisations should include a personal data protection notice.

Develop Policy - External Data Protection Notices

• An external data protection policy or Privacy Policy, typically on a company website, outlines how the company handles and communicates its handling of personal data to external stakeholders.
• The external notice reflects the contents of the internal data protection policy.
• Notice should clearly detail an individual's rights concerning their personal data, for example, the right to access, the correct, withdraw, and what they can do to contact the Data Protection Officer (DPO).
• Organisations must clarify how stakeholders can contact a DPO in case of queries or complaints.
• Notices may include different scenarios, like contract, consent forms, applications to organisations, etc.
• Organisations must use plain language; avoid excessive legal jargon.
• Consider a layered approach (through hyperlinks) for complex information.

Develop Policy - Management Approvals

• In some organisations, senior management teams manage and sign off the processes and policies, while in others the DPO endorses the DPMP and submits it for senior management approval.
• The process of approval varies based on organizational structure and internal rules.

Develop Policy - Regular Reviews of Policies

• Policy review and update are crucial to stay abreast of legislative changes, data breaches, major business changes, and enforcement decisions.
• Organisations should conduct periodic reviews of their policies.
• Review should include feedback from employees, complaints regarding data handling, relevant industry trends, international best practices, and PDPC guidelines/enforcement decisions/publications.

Develop People - Structuring The Team, Roles, and Responsibilities

• Organisations need a data protection office/function.
• This may include a dedicated Data Protection Officer (DPO) or a DPO-led team, or a governance committee handling data protection matters. Teams should be staffed with department representatives dealing with data in their area, communication and training specialists, data access/correction experts, legal experts, and likely an internal auditing department.

Develop People - Communication and Training Strategies

• Data protection considerations span all organizational levels, including volunteers, agents, and contract staff.
• Staff and contractors should be trained on data protection policies and SOPs.
• Training should be ongoing and should include: onboarding, specific job role assignments, ongoing training updates, refresher information, and promotion based on data protection responsibilities.
• Organisations must make personal data protection easily accessible. Regular communication plans should be in place to effectively disseminate necessary data protection information.

Develop Process - HR Policies and Practices

• Organisations must have clear HR policies that align employee/contractor dealings with data handling procedures.
• Policies should cover screening, background checks, confidentiality agreements, information security, and handling procedures.
• Policy must require compliant data handling from employees/contractors.
• Clear procedures should encompass the employee's/contractor's usage, handling, and safeguarding data following termination/separation of service.

Develop Process – Access, Correction, and Data Porting Requests

• Organisations should create policies outlining processes for access, correction, and data porting requests.
• These processes need to comply with data protection obligations, including procedures regarding request forms, data location criteria, handling, fees, verification of the requester, exceptions, and records keeping procedures for requests.

Develop Process – Establish Risk Monitoring, Reporting, and Internal Audit Structure

• Establish a comprehensive enterprise risk management framework with proper monitoring and reporting mechanisms.
• The DPO must regularly monitor and report identified risks to senior management.
• This framework must include clear reporting mechanisms on data protection compliance risks.
• Establish a framework for a documented process to report, track, and escalate issues.
• Employ internal audits to monitor the effectiveness of data protection measures and identify areas for improvement.