by Teng Teng Koh
Share
Share
Under the PDPA, MCSTs are required to take reasonable steps to protect this data from unauthorised access, loss, or misuse. This is known as the Protection Obligation. PDPC enforcement decision published on 3 Jul 2025 (Case No. DP-2406-C2585) show that organisations are penalised not only when a breach occurs, but when basic security measures are missing or poorly managed
“We Outsourced It” Is Not a Defence
A common assumption is that security and IT risks sit with managing agents, security vendors, or system providers. However, the PDPC has been clear: outsourcing operations does not outsource responsibility.
For MCSTs, this means:
- Knowing who has access to CCTV systems and personal data
- Ensuring passwords, access rights, and system controls are properly managed
- Periodically reviewing whether existing arrangements are still adequate
- Making sure vendors are not operating on assumptions or outdated practices
Many breaches occur not because of sophisticated attacks, but because of simple gaps: shared passwords, unrestricted administrator access, or no one checking whether safeguards still work.
Prevention Is Simpler Than Recovery
Once a data breach occurs, the consequences can be serious: regulatory investigations, financial penalties, reputational damage, and loss of trust from residents. Preventing these situations usually requires far less effort than dealing with the aftermath.
The PDPC has repeatedly emphasised that organisations are expected to take reasonable and proportionate steps based on the type of data they hold and how it is used, i.e.: be prepared.
How We Help MCSTs Stay Protected
Our outsourced compliance and DPO services help MCSTs put practical safeguards in place without disrupting daily operations.
We support MCSTs by:
- Identifying common data protection gaps in day-to-day operations
- Clarifying responsibilities between the MCST, managing agent, and vendors
- Reviewing access controls and basic security practices
- Putting clear procedures in place to reduce breach risk
- Acting as the MCST’s point of contact if an incident occurs
Good protection is not about fear. It is about knowing your risks, and managing them before they become problems.
Most MCSTs assume data protection issues only arise when there is a complaint. In reality, many breaches happen quietly. Weak passwords, unsecured systems, or unclear responsibilities between managing agents and vendors. By the time something goes wrong, it is often too late.
When a resident asks for CCTV footage, it rarely comes with a manual. Do you check with the managing agent? Security? The council? PDPA expectations are clear, but day-to-day handling often isn’t.
On 25 September 2025, the Monetary Authority of Singapore (MAS) issued the Guidelines on Standards of Conduct for Digital Advertising Activities. These new rules, effective 25 March 2026, apply to all financial institutions (FIs) and their appointed digital marketers — including agencies, affiliates, and influencers (“finfluencers”).
