Find out where your PDPA policy falls short.
We review your data protection policy, or run a gap assessment if you don't have one, and give you a clear report on what to fix first. $500 per session.
A clear report, not a 50-page pack.
We read your data protection policy against the PDPA and tell you, in plain English, where it falls short and what to fix first.
- Review of one existing policy, or a PDPA gap assessment if you don't have one yet.
- A written report flagging gaps against the PDPA's obligations, one by one.
- Prioritised recommendations on what to fix first.
- One walkthrough call to go through the findings with you.
Your policy against the PDPA's obligations.
These are the main obligations we check your policy and practices against.
| Obligation | The question we ask |
|---|---|
| Consent | Do you get valid consent before collecting, using or disclosing personal data? |
| Purpose limitation | Do you only use data for purposes a reasonable person would consider appropriate? |
| Notification | Do you tell people why you're collecting their data? |
| Access and correction | Can you handle a request to see or correct someone's data? |
| Accuracy | Do you keep data accurate and complete where it matters? |
| Protection | Are your security arrangements reasonable for the data you hold? |
| Retention limitation | Do you stop keeping data once you no longer need it? |
| Transfer limitation | Is data sent overseas protected to a comparable standard? |
| Accountability | Are your policies written down, and can you show them when asked? |
| Data breach notification | Do you have a process to assess and report a breach on time? |
The first step, not the whole build.
A review is a fixed piece of work against an existing document. If it shows you need a full policy drafted, or a Data Protection Management Programme (DPMP) or DPIA built out, we'll scope and quote that separately once we've seen your setup. There's no obligation to go further.
Don't have a DPO yet? Pair the review with our DPO as a Service so someone owns the fixes.
Questions about policy reviews.
Yes. The PDPA's Accountability Obligation requires organisations to have policies and practices in place to meet their PDPA duties, and to make information about them available to people who ask.
Yes. If you don't have a policy, we run a gap assessment instead and tell you what your business needs to put in place.
A review checks one existing document against the PDPA. A DPMP is your whole data protection framework: policies, processes and governance. Building one means mapping your data flows and drafting from scratch, so it's quoted separately.
A DPIA is a risk assessment for a particular system or process. Its findings feed into your DPMP, so it's a component of building or maintaining one rather than a separate deliverable.
$500 per session, covering one policy (or a gap assessment), a written report, prioritised recommendations and a walkthrough call.
General guidance only, not a substitute for legal advice. Full detail at pdpc.gov.sg.
More from Core Vault.
Know exactly what to fix.
Send us your policy, or tell us you don't have one, and we'll take it from there.