【跨境合规】新加坡《个人信息保护法》（PDPA ）中英对照摘录（三）

第三章 关于个人数据保护和问责的一般规则

11. 合规要求

（1）任何组织在依本法承担责任时，应考虑是否符合一个理性人在此情况下的合理预期。

（2）组织对其拥有或控制的个人数据负责。

（3）组织应当指派一名或多名个人负责确保该组织遵守本法。

（4）根据第(3)款被指派的个人可将该指派赋予的责任委派给他人。

（5）组织应当向公众提供至少一名根据上述第(3)款指派或根据第(4)款委派的个人的业务联系信息。

（5A）在不局限于第(5)款的情况下，某组织以规定方式提供第(3)款所述个人的业务联系信息的，视为该组织已满足该款要求。

（6）组织根据第(3)款指派个人并不免除该组织根据本法应承担的义务。

12. 政策与措施

组织应当：

（a）制定并实施必要的政策和措施，以履行本法对其规定的义务；

（b）制定流程，接收并回应在本法适用时可能出现的投诉；

（c）向员工传达(a)段所述组织政策和措施等相关信息；

（d）并应要求提供以下相关信息：

（i）(a)段所述政策和措施；

（ii）(b)段所述投诉流程。

PART 3 GENERAL RULES WITH RESPECT TO PROTECTION OF AND ACCOUNTABILITY FOR PERSONAL DATA

(1)In meeting its responsibilities under this Act,an organisation must consider what a reasonable person would consider appropriate in the circumstances.

(2) An organisation is responsible for personal data in its possession or under its control.

(3) An organisation must designate one or more individuals to be responsible for ensuring that the organisation complies with this Act.

(4) An individual designated under subsection (3) may delegate to another individual the responsibility conferred by that designation.

(5) An organisation must make available to the public the business contact information of at least one of the individuals designated under subsection (3) or delegated under subsection (4).

(5A) Without limiting subsection (5), an organisation is deemed to have satisfied that subsection if the organisation makes available the business contact information of any individual mentioned in subsection (3) in any prescribed manner.

(6) The designation of an individual by an organisation under subsection (3) does not relieve the organisation of any of its obligations under this Act.

12. Policies and practices

An organisation must—

(a) develop and implement policies and practices that are necessary for the organisation to meet the obligations of the organisation under this Act;

(b) develop a process to receive and respond to complaints that may arise with respect to the application of this Act;

(c) communicate to its staff information about the organisation's policies and practices mentioned in paragraph (a); and

(d) make information available on request about—

(i) the policies and practices mentioned in paragraph (a); and

(ii) the complaint process mentioned in paragraph (b).