PDPA compliance toolkit for Singapore SMEs

PDPA compliance toolkit that finds and masks personal data in your documents and logs every access request with its due date, so each answer goes out on time.

How it works

  1. Documents and requests come inDocuments and access requests arrive.
  2. Personal data found and maskedPersonal data in documents is found and masked.
  3. Access requests logged and trackedEach access request is logged with its due date.
  4. Answered on timeReplies go out before the deadline.

A worked example

  1. A recruitment agency in Raffles Place receives a letter from a former candidate asking what personal data it holds about her.
  2. The request is logged with its due date. The system searches the agency's Google Drive and Gmail and gathers the documents that mention her.
  3. Before the files are shared, other people's NRIC numbers and phone numbers in those documents are found and masked.
  4. The agency's data protection officer reviews the pack and the draft reply, approves it, and sends it before the deadline.

What is included

  • A request log with due dates and reminders.
  • A search across the Google Drive and Gmail areas agreed with you.
  • Masking of personal data in documents.
  • Draft replies for your review.
  • A short guide for the person who handles requests.
  • Fixes and adjustments during the first month after launch.

What is not included

  • Legal advice, or the work of a data protection officer.
  • Filing anything with the authorities on your behalf.
  • A full PDPA audit of your business.

Works with

  • Google Drive
  • Gmail

Questions

How much does the PDPA compliance toolkit cost?

Setup starts from S$3,499. The monthly fee is set by your volume and agreed on the call, before anything is built. Usage costs, such as AI processing, are billed on top of the monthly fee. Subscriptions you already pay for, such as Xero or Google Workspace, remain yours. The minimum term is three months, and after that you can cancel any time.

Where does my data go, and does this meet PDPA?

Documents stay in your own tools, such as Google Drive and Gmail, wherever possible. The toolkit works on personal data by design, so the written scope states what it reads, what it masks and who can see the results. The written scope says where everything is stored and lists any personal data the system handles and why, so you can check it against your own PDPA obligations. Your data is never used to train AI models.

Does this make my business compliant with the PDPA?

No. It helps you meet deadlines and handle requests more carefully. Your obligations stay with your business, and your data protection officer or adviser remains responsible for them. It does not file anything for you.

What happens when the AI is not sure whether something is personal data?

It flags the item for a person to decide. It leaves the original untouched and shows what it would mask, so nothing is changed without your review.

How long does setup take?

Usually two to three weeks from the call. We agree where your documents live, set up the log and masking, and test on sample files before it handles a real request.

Other back office systems