What are the key provisions of the Personal Data Protection Act (PDPA) in Singapore?

The key provisions of the Personal Data Protection Act (PDPA) in Singapore include:

1. Consent: Organizations must obtain individuals' consent before collecting, using, or disclosing their personal data.

2. Purpose Limitation: Personal data can only be collected for specific purposes that have been notified to the individual, and cannot be used for any other purposes without obtaining further consent.

3. Notification: Organizations must inform individuals of the purposes for collecting, using, or disclosing their personal data, as well as the identity of the organization collecting the data.

4. Access and Correction: Individuals have the right to request access to their personal data held by organizations, and to request corrections if the data is inaccurate or incomplete.

5. Accuracy: Organizations must make reasonable efforts to ensure that personal data collected is accurate and up-to-date.

6. Protection: Organizations are required to protect personal data in their possession or control against unauthorized access, disclosure, or misuse.

7. Retention Limitation: Personal data should not be kept for longer than necessary to fulfill the purposes for which it was collected, unless required by law.

8. Transfer Limitation: Organizations must ensure that personal data transferred to another country is protected by comparable data protection laws or contractual obligations.

9. Accountability: Organizations are responsible for the personal data in their possession or control, and must implement policies and practices to comply with the PDPA.

10. Enforcement: The PDPA establishes the Personal Data Protection Commission (PDPC) as the enforcement authority, with the power to investigate and take enforcement actions against organizations that breach the PDPA.