Answers
The questions your customers keep asking you.
One question per page, answered the way a colleague would answer it. Written for a 10 to 200 person Singapore company with no risk or compliance hire. Nothing here is gated.
PDPA
6 min read
A customer sent us a vendor security questionnaire. What do we do?
Answer it in one pass, evidence what you can, and write "in progress, owned by, due by" for the rest — a half-answered questionnaire is what kills the deal, not an honest gap.
PDPA
6 min read
Do we have to notify PDPC about this data breach?
You must notify PDPC if the breach is likely to cause significant harm to any individual, or if it affects 500 or more individuals — within 3 calendar days of assessing it, and you have 30 days to complete that assessment.
Finance and Operations
6 min read
How do we have segregation of duties when finance is two people?
You cannot fully separate the four finance duties with two people, so separate the two that matter — whoever sets up a payee must never be the person who releases the payment — and put a compensating review over the rest.
Where do you actually stand?
A Readiness Report covers one Domain — PDPA, Finance and Operations, or Sustainability — and writes every gap as a finding with its severity, the obligation it maps to, what it commercially blocks, and the first action with an owner and an effort estimate. S$690, issued within 2 business days of your answers.