When a data protection officer leaves while a customer complaint is unresolved, the company should appoint a responsible replacement or interim owner, preserve the complaint file and ensure the complainant still has a working contact route. Changing the name on a staff list does not transfer the actual correspondence, open decisions or access needed to continue the matter.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
The PDPC’s accountability guidance calls for a designated DPO and publicly available business contact information. A sensible departure plan turns that responsibility into a practical handover.
Start with the live complaint, not the employee’s entire mailbox
Create a chronology containing the original complaint, acknowledgements, requests for clarification and substantive replies. Identify what has been promised and what has actually been completed. Mark an unanswered question as open rather than describing the file as closed because the previous officer is leaving.
The departing officer may hold unrelated personal or sensitive correspondence. Use an authorised retrieval process for business records, with access restricted to the people handling the matter. Avoid a blanket instruction to copy their entire mailbox to every director.
Make the handover decision explicit
Name the person responsible for responding, the person authorised to make disputed decisions and the technical contact who can retrieve the relevant records. A replacement DPO may need operational help from HR, finance or IT. A list of names is useful only if those people know the tasks assigned to them.
Where an external adviser is involved, distinguish the adviser’s role from the company’s own responsibilities. Clarify which advice is confidential or privileged and who should receive it. Do not mix legal advice into a general complaint folder with unrestricted staff access.
Build a short handover file
| Item | What the incoming officer needs |
|---|---|
| Complaint chronology | Dates, messages, responses and unresolved questions |
| Record locations | The relevant systems, custodians and controlled access route |
| Decision log | What was decided, by whom and on what basis |
| Action tracker | Next action, responsible person and applicable timing |
| Contact arrangements | The address or number the complainant and staff should use |
Keep the file focused. The incoming officer needs enough information to continue the complaint, not an unsupported narrative blaming the departing employee.
Example: an access question is still outstanding
A customer has asked why part of a response was withheld. The original DPO has requested advice but leaves before it arrives. The handover should show that the question remains open, where the request for advice is stored and who will receive the answer. A generic note saying “legal is handling it” creates uncertainty about both ownership and the next response.
Test the contact route before disabling the old account
Check that the public privacy contact reaches a monitored mailbox, that authorised staff can access it and that forwarding arrangements work as intended. If the public details identify the departing person, arrange an appropriate update. Preserve relevant records before account access is withdrawn.
Tell the complainant about a change of contact where appropriate, without disclosing unnecessary staff details. A neutral explanation that a new officer is handling the matter is usually more useful than a description of an internal employment dispute.
Keep accountability visible after the handover
Ask the incoming owner to confirm that the file is complete enough to proceed, identify missing records and set the next action. Directors should receive a factual status report proportionate to the issue. Do not treat receipt of a folder as evidence that the complaint has been resolved.
Also review whether the departure exposes a wider dependency on one person: access credentials, undocumented retention decisions or an unmonitored complaints inbox. Correct the practical weakness while keeping the live complaint moving.
Can the company secretary automatically take over?
They may be a suitable person, but the company should make an actual appointment or assignment and ensure they have the competence, support and access needed. A job title alone does not complete the handover.
Should we start the complaint again?
Preserve the existing chronology. A staff change should not erase correspondence or obscure commitments already made.
Related guidance
- Mapping the personal data your company holds
- Organising a data protection management programme
- Background on company data protection obligations
Help with company compliance and privacy matters
If you would like assistance organising your company’s compliance procedures or obtaining advice on a privacy issue, email [email protected] or WhatsApp +65 8501 7133. Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist. This is general information; legal advice should address the facts of the particular request or dispute.