Singapore legislation
Regulation 15
Regulation 15
Assessment of effect of proposed collection, use or disclosure of personal data for purposes of Part 3 of First Schedule to Act
Subregulation 1
This regulation applies where an organisation intends to collect, use or disclose personal data about an individual under paragraph 1(1) of Part 3 of the First Schedule to the Act.
Subregulation 2
An assessment mentioned in paragraph 1(2)(a) of Part 3 of the First Schedule to the Act in respect of the intended collection, use or disclosure of personal data must —
specify —
the types and volume of personal data to be collected, used or disclosed, as the case may be;
the purpose or purposes for which the personal data will be collected, used or disclosed, as the case may be; and
the method or methods by which the personal data will be collected, used or disclosed, as the case may be;
identify any residual adverse effect on any individual after implementing any reasonable measures mentioned in paragraph 1(3)(b) of Part 3 of the First Schedule to the Act;
identify the legitimate interests that justify the collection, use or disclosure (as the case may be) by the organisation of personal data about the individual;
where the legitimate interests identified under sub‑paragraph (c) relate to a person other than the organisation, identify that other person by name or description; and
set out the reasons for the organisation’s conclusion that the legitimate interests identified under sub‑paragraph (c) outweigh any adverse effect on the individual.
Subregulation 3
The organisation must retain a copy of the assessment it conducted in accordance with paragraph 1(2)(a) of Part 3 of the First Schedule to the Act relating to the collection, use or disclosure of personal data about an individual throughout the period that the organisation collects, uses or discloses personal data about the individual under paragraph 1(1) of Part 3 of the First Schedule to the Act.