Introduction

The PDPC is empowered to investigate and enforce the PDPA provisions.

Enforcement of the Data Protection and Do Not Call (DNC) Provisions

If the PDPC finds that an organisation has breached any of the PDPA provisions, we will direct the organisation to take steps to ensure compliance such as:

• Stop collecting, using or disclosing personal data in contravention of the Act;
• Destroy personal data collected in contravention of the Act;
• Provide access to or correct the personal data; and/or
• Pay a financial penalty.

For more information, refer to the Advisory Guidelines on Enforcement of the Data Protection Provisions and the Advisory Guidelines on the Do Not Call Provisions.

Offences Related to The PDPC's Powers of Investigation 

An organisation or a person is guilty of an offence if any of the following is committed:

• Altering, falsifying, concealing or destroying personal data or information about the collection, use or disclosure of personal data;
• Obstructing the PDPC or an authorised officer from carrying out their duties under the Act;
• Misleading the PDPC in its investigations (e.g. by making a false statement); or
• Requesting to access or correct another individual’s personal data without that individual’s authorisation.

Data Protection Appeal Panel

The Data Protection Appeal Panel is an independent body that hears appeals against directions or decisions of the PDPC in relation to data protection provisions in the PDPA. 

For more information about the appeal process, please click here.