If someone asks for their personal data through a director’s personal email account, the company should route the request to its responsible privacy contact, preserve the original message and establish what the person is requesting. Simply telling the sender to start again through a website form can lose important context and delay the company’s response. At the same time, the director should not send a mailbox export or company file before the scope, identity and applicable rights have been checked.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
Is this an individual’s access request or a different company request?
Start with the wording. A customer seeking personal information held about them is asking something different from a shareholder seeking inspection of a company register, or a supplier demanding a contract file. One email may contain more than one request. Record each part and identify which process should handle it.
The PDPC’s obligations guidance describes access to an individual’s personal data and information on its use or disclosure. Exceptions can apply. This does not establish a general right to every company document.
Preserve the first message and make one controlled handover
Keep the message with its arrival time, attachments and any earlier correspondence. Forward it through an authorised company channel to the person handling privacy requests. Avoid circulating it to a large group simply because several people might have relevant information.
A useful handover identifies the sender, what they asked for, when it arrived and why the director believes the company may hold the information. It should distinguish facts from assumptions. If the director has already replied, include that reply so the responsible person does not unknowingly contradict it.
Example: a former customer contacts the founder
A former customer writes to the founder’s personal address asking for records of calls with the sales team. The founder has a few emails, while the company’s call records sit in another system. Sending only the founder’s emails could give an incomplete impression. A coordinated search can identify the relevant repositories and review the information before a response is prepared.
Verify identity proportionately
Use the company’s established verification process and consider the sensitivity of the material sought. An address that resembles a customer’s name is not enough to release confidential records. Equally, asking for a full passport copy as a routine response to every request can create an unnecessary additional store of sensitive information.
Record what was checked and who accepted the verification. Where an agent makes the request, assess the agent’s authority as well as the identity of the individual concerned. Refer uncertain or disputed cases for advice rather than improvising a universal rule.
Search relevant systems without exporting everything
- Identify the accounts, date range and records described by the requester.
- Ask the relevant custodians to preserve and locate potentially responsive material.
- Keep a search record showing the systems examined and any genuine limitations.
- Separate the requester’s data from third-party information and material needing legal review.
- Use a controlled working copy instead of attaching an unreviewed shared folder.
Do not delete or overwrite relevant records while deciding what response is appropriate. Routine clean-up should be paused for the material under review where necessary.
Prepare an answer the company can stand behind
The authorised responder should explain the outcome accurately, use a secure delivery method and retain a record of the response. If the request is unclear, seek the clarification actually needed. If part cannot be provided, obtain advice on the applicable basis and communicate the position appropriately. Keep response timing under active review using the applicable PDPC guidance and regulations.
A director can help locate records without personally deciding every disclosure question. Clear ownership matters most when correspondence is split across personal and business accounts.
Can we insist that all requests use our form?
A form can help collect information, but do not assume that a request arriving elsewhere can be ignored. Assess the communication and arrange a practical handover.
Must we disclose other people’s messages in full?
Not automatically. Review the personal data requested, the information about other people and the applicable exceptions before deciding the response.
Related guidance
- Mapping the personal data your company holds
- Organising a data protection management programme
- Background on company data protection obligations
Help with company compliance and privacy matters
If you would like assistance organising your company’s compliance procedures or obtaining advice on a privacy issue, email [email protected] or WhatsApp +65 8501 7133. Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist. This is general information; legal advice should address the facts of the particular request or dispute.