PDPA education

Learn from the case

Each article separates general legal education from the facts of this particular case, and none of it is a legal determination.

• Purpose Limitation

  Personal data collected for one purpose should not be reused for an incompatible purpose without a proper basis.

• Data Minimisation

  Only data that is adequate, relevant and limited to what is necessary should be processed — or made visible.

• Lawful Basis

  Every processing activity needs a lawful basis — consent is only one of several.

• Controller vs Processor

  The controller decides why and how data is processed; the processor acts on instructions.

• Data Subject Access Rights

  A data subject may request access to their personal data and information about how it is processed.

• ROPA

  A record of processing activities documents what data is processed, why, by whom and for how long.

• Access Logs and Audit Logs

  Logs can show who viewed which record, when, and under which role.

• Role of the DPO

  A data protection officer advises, monitors compliance and acts as a contact point for data subjects.

• Evidence Preservation

  A preservation notice asks an organisation to retain relevant records while a dispute is live.

• Original Evidence vs Transcript

  A transcript is a derivative record. Its accuracy can normally only be tested against the source.

• Complaint Escalation

  A complaint can move between an organisation, a sector regulator, a consumer authority and a data protection authority.