PDPC (Personal Data Protection Commission)

Explain Like I’m Five

PDPA names the law governing how organisations collect, use and share personal data. PDPC names the authority responsible for that law. A company holding customer information is a separate participant: it handles the data, while PDPC oversees the rules.

Where You’ll Run Into It

In discussions about a business’s handling of customer information, including identity details such as an NRIC number. An organisation’s data practices and the authority overseeing them are different things.

The similar-looking initials IMDA name the infocomm and media authority. Singpass is a digital identity service used to log in; it is not the personal-data regulator.

Example

“This shop says it follows the PDPA. Is PDPC the company storing my details?”

No. The shop is referring to the law it must follow. PDPC is the authority administering and enforcing that law, rather than the shop or its customer database.

The Part People Get Wrong

PDPC and PDPA are not interchangeable abbreviations. One is the authority; the other is the Act. PDPC can exercise enforcement powers, including directing an organisation to stop certain handling of data when requirements are not met. The applicable rules depend on the situation.