Singapore PDPA Anonymisation and DPIA records

Start the record by stating the intended use: internal analysis, external sharing, application testing, long-term analysis, or a controlled data-sharing arrangement. Removing names does not by itself take a dataset outside the PDPA. PDPC's basic anonymisation guide treats de-identified internal data as still personal data where it is likely to be easily re-identifiable, while external-sharing and long-term-analysis use cases require the full anonymisation process and continuing controls before the output can be treated as anonymised.

For data sharing, the IMDA and PDPC Trusted Data Sharing Framework says providers should first consider whether anonymised data can meet the sharing objective. If identifiable data is needed, the record should switch from an anonymisation conclusion to the relevant PDPA compliance analysis for purpose, consent or an applicable exception.

An anonymisation record should be more than a list of techniques. The current PDPC guide uses a five-step process: know your data, de-identify your data, apply anonymisation techniques, compute your risk, and manage re-identification and disclosure risks.

The release model changes the risk conclusion. Public release has more difficult anonymisation challenges than a non-public release to a fixed set of known recipients, and contractual access restrictions cannot be assumed for an unrestricted public dataset. Reassess the result when new datasets, recipients, techniques, or external data sources make re-identification more likely.

PDPC guidance encourages organisations to conduct DPIAs when deciding policies and practices for PDPA compliance. A DPIA identifies, assesses, and addresses personal data protection risks based on the organisation's functions, needs, and processes. This is non-binding, non-exhaustive guidance: using the PDPC template does not by itself establish compliance with the binding PDPA duties.

The DPIA need assessment should ask whether the project involves collection, use, transfer, disclosure, or storage of personal data. If it does, PDPC threshold questions support a DPIA for a new system or process, a substantially redesigned existing system or process, or collection of new types of personal data.

Keep the data-flow map and action plan with the DPIA report. PDPC's DPIA lifecycle asks teams to identify personal data and personal data flows, assess risks against PDPA requirements or best practices, create an action plan, then implement and monitor outcomes.

For an anonymisation-heavy project, the DPIA should show where identifiable personal data enters, where it is transformed, who receives de-identified or anonymised outputs, what residual re-identification risk remains, and what technical, contractual, organisational, or training controls reduce that risk.