Plain-English PDPA glossary: data protection and cyber terms

Access request: a person’s request to see the personal data you hold about them and how it has been used.

Accountability Obligation: the Personal Data Protection Act (PDPA) rule that you appoint a data protection officer, keep written policies and can show you follow them.

Anti-malware: software on each device that blocks and removes harmful programs, kept up to date.

Backup: a separate copy of your data that you can restore if the original is lost, locked or deleted.

Breach notification: telling the Personal Data Protection Commission (PDPC), and where needed the people affected, about a notifiable data breach.

Business continuity: keeping your critical services running during an outage, a cyber attack or the loss of a site.

CCTV notice: a sign telling people that closed-circuit television (CCTV) cameras are recording, and why.

Certification body: an independent organisation that audits you against a standard and issues the certificate.

Consent: a person’s agreement to the purposes for which you collect, use or disclose their personal data.

Cyber Essentials mark: a certification showing that basic cyber protections are in place, such as updated devices, strong passwords, backups and trained staff.

Cyber hygiene: the everyday habits that keep accounts and devices safe, such as updates, strong passwords and care with links.

Cyber insurance: insurance that covers some costs of a cyber incident, usually on condition that agreed security controls are in place.

Cyber Trust mark: a risk-based cyber security certification in five tiers, from Supporter to Advocate.

Data breach: personal data that is lost, stolen or seen by someone who should not see it, by accident or by attack.

Data inventory: a list of the personal data you hold, where it sits, who can see it and how long you keep it.

Data intermediary: an organisation that processes personal data for another organisation, such as a payroll or IT vendor.

Data processing agreement: a contract that sets out how a vendor must handle the personal data it processes for you.

Data Protection Essentials: a baseline of data protection practices for small organisations, set out in a framework published by the Infocomm Media Development Authority (IMDA).

Data Protection Impact Assessment (DPIA): a check of a new system or process for privacy risks before it goes live.

Data protection officer (DPO): the person who makes sure your organisation keeps its promises about personal data, on your staff or a named adviser from us.

Data Protection Trustmark (DPTM): a Singapore certification showing that an independent body has checked how you collect, use and protect personal data.

Deemed consent: consent the law treats as given, for example when a person volunteers data for an obvious purpose.

Device management: software that keeps company laptops and phones updated and locked, and can wipe a lost device remotely; also called mobile device management (MDM).

Digital forensics: detective work on computers after an incident, to find what happened, how, and what was taken.

Do Not Call (DNC) Registry: Singapore’s register of phone numbers that must not receive marketing calls, texts or faxes without consent.

Encryption: scrambling data so that only someone with the key can read it.

Endpoint: any device people work on, such as a laptop, phone or tablet.

Firewall: a device or software that controls what traffic can enter or leave your network.

Health Information Act (HIA): the Singapore law that sets rules for sharing and protecting health information, including cyber and data security for healthcare providers.

Incident response plan: a short written plan that says who does what when a cyber incident or data breach happens.

ISO/IEC 27001: the international standard for running information security as a managed system, checked by a certification body every year.

ISO/IEC 27701: the international standard for managing privacy and personal data, often run with ISO/IEC 27001.

ISO 22301: the international standard for business continuity, like a fire drill for the whole business.

ISO/IEC 42001: the international standard for managing the use of artificial intelligence safely and fairly.

Managing agent: the company a condominium’s management corporation hires to run the estate day to day, including residents’ data.

Management corporation (MCST): the body that runs a strata development such as a condominium, through its elected council.

Multi-factor authentication (MFA): a login that needs a second proof, such as a code on your phone, as well as a password.

Notifiable breach: a data breach that is likely to cause significant harm, or affects 500 or more people, and must be reported to the PDPC.

NRIC: the National Registration Identity Card number, which organisations may collect when the law requires it or identity must be verified to a high degree.

Patch: a software update that fixes a security weakness.

Penetration test: a licensed, friendly break-in attempt that finds weak spots before criminals do.

Personal data: data about a person who can be identified from it, alone or with other information you hold.

Personal Data Protection Act (PDPA): Singapore’s law on how organisations collect, use, disclose and protect personal data.

Personal Data Protection Commission (PDPC): the body that administers and enforces the PDPA.

Phishing: a fake email or message that tries to trick someone into clicking a link, paying money or giving away a password.

Privacy notice: a public statement that tells people what personal data you collect, why, and how to contact your DPO.

Protection Obligation: the PDPA rule that you make reasonable security arrangements for the personal data you hold.

Ransomware: malicious software that locks or steals your data and demands payment.

Retention: how long you keep personal data; the PDPA expects you to stop keeping it once the purpose is served.

Risk assessment: a structured look at what could go wrong, how likely it is and how much it would hurt.

Segmentation: splitting a network into separate parts, so one infected device cannot reach everything.

Significant harm: the level of harm that makes a data breach notifiable; breaches of certain data, such as bank or health details, are treated as causing it.

SS 714: the Singapore Standard behind the Data Protection Trustmark.

Tabletop exercise: a rehearsal around a table where your team talks through a realistic incident, step by step.

Transfer Limitation Obligation: the PDPA rule that personal data sent overseas must stay protected to a comparable standard.

Vendor due diligence: checking how a vendor protects data before you share any with it.

Virtual CISO: a senior security lead who works for you part-time, in place of a full-time chief information security officer (CISO).

Vulnerability assessment: a scan for known weaknesses in your systems, websites and devices.