Loyalty List, NRIC Logging, and a Three-Day Breach Clock
Kopi & Co is a Singapore-incorporated online grocer with 410,000 registered users. Joining the loyalty programme requires ticking a box that says membership 'may involve receiving offers from us and our partners'; 90,000 members did so. Separately, Kopi & Co bought 12,000 phone numbers from a marketing broker in 2022 and added them to the same list; roughly 6,000 of those numbers have been on the Do Not Call Registry since 2021. At a pop-up collection point, staff check NRIC cards to confirm buyers are over 21 before handing over alcohol, and then type the full NRIC number into a spreadsheet that syncs nightly to a warehouse contractor in Johor Bahru. On 4 June a security engineer found an unauthenticated cloud storage bucket containing 3,200 customers' names, addresses, mobile numbers and password hashes, each hash stored alongside its plaintext salt. The engineer finished scoping the affected population on 11 June. The DPO has to decide what to tell the PDPC, what to tell customers, and whether the loyalty terms can stay as they are.
1. Can Kopi & Co send its June SMS campaign to the 12,000 purchased numbers and to the 6,000 DNC-registered numbers? Set out the analysis under the PDPA consent and Do Not Call provisions.
Read the worked answer
Two separate rules apply, and both fail.
Purchased numbers. Consent must be clear and unambiguous, and the burden of proving it sits with the sender. Numbers bought from a broker carry no consent from the individuals themselves; a broker's contractual assurance is not evidence of consent given by the subscriber. Marketing to that cohort breaches the consent obligation and, for any number that is a Singapore telephone number, the DNC provisions as well.
DNC-registered numbers. For specified messages the sender must either check the register and refrain from sending to registered numbers, or hold clear and unambiguous consent in evidential form. 'May involve receiving offers from us and our partners' is bundled, vague, and does not identify senders or channels; it is not clear consent. Deemed consent by notification cannot rescue it, because the DNC regime does not allow a negative-option notification to substitute for clear and unambiguous consent.
Partners' offers. Even a valid consent would need to cover disclosure to third-party partners by class. Deemed consent by contractual necessity or business improvement does not extend to third-party marketing.
Remedy. Scrub both cohorts, run a register check immediately before every send, rebuild consent as a separate unbundled opt-in naming channels and recipient classes, and retain the records - that evidence is what the PDPC asks for in enforcement.
2. Is the NRIC practice and the Johor Bahru spreadsheet permissible? What must change?
Read the worked answer
NRIC collection. Since 1 September 2019 the PDPC's advisory guidance has restricted collection of NRIC numbers: an organisation may collect or record the number only where required by law, or where it is necessary to accurately verify identity to a high degree of fidelity. Checking a card to confirm a buyer is over 21 is a legitimate verification purpose, but visual verification needs the date of birth and photograph, not the number. Typing the full number into a spreadsheet fails the collection limitation and retention limitation obligations, because the number is neither needed for the purpose nor needed after the check.
The Johor contractor. The warehouse operator is a data intermediary for this data: the protection obligation applies directly to it, but Kopi & Co remains responsible and must impose security requirements by written contract. Sync points and access rights must be limited to what the purpose requires.
Overseas transfer. Sending the spreadsheet to Malaysia is a transfer under the PDPA's transfer limitation rule, which permits it only where the data receives protection comparable to the PDPA or an exception applies. A shared spreadsheet of full NRIC numbers plainly does not meet that standard, and consent or contractual necessity is not established on these facts.
Fix. Stop recording the number; if a log is genuinely needed, mask it (S1234567A becomes ****567A); move verification to an access-controlled system; and either keep the data in Singapore or support the Johor arrangement with a compliant contract plus a documented transfer assessment.
3. Is the incident notifiable, and by when must the PDPC and customers be told?
Read the worked answer
It is notifiable.
Threshold. A breach is notifiable if it results in, or is likely to result in, significant harm, or if it is of a significant scale - 500 or more affected individuals. With 3,200 records the scale limb is met on its own. The name, address, mobile number and password combination is also a ready-made phishing and account-takeover kit, so significant harm is independently arguable even without plaintext passwords.
The clock. The organisation must assess whether a breach is notifiable as soon as practicable; PDPC guidance expects assessment to be completed within 30 calendar days of discovery. The 3-calendar-day notification window runs from the day the organisation concludes that the breach is notifiable. Here that is 11 June, so the notification must reach the PDPC no later than 14 June, with affected individuals notified at the same time or afterwards.
Content. Cause and timeline, the categories and number of individuals affected, remedial action taken (bucket secured, sessions and credentials reset, hashing re-implemented with a modern algorithm and separate pepper), and a contact point.
Trap to avoid. Waiting for the full forensic report is not a defence, and neither is a completed scoping exercise. The duty is triggered by the assessment conclusion, not by certainty; delaying from 4 to 11 June is defensible only if the assessment genuinely required it. Poor handling of the 3-day window is itself a likely enforcement finding.