Company: OTSA
Filing Date: 2025-07-16
Form Type: F-1/A
Source: 0001213900-25-064434
Chunk: 208

Company: OTSAW Ltd
Filing Date: 2025-07-16
Form: F-1/A
Chunk 208
---
 the collection, use and disclosure of personal data by organizations in Singapore to safeguard personal data, buttress public trust in the digital economy and spark data innovation. The PDPA is administered and enforced by the regulator, the Personal Data Protection Commission. It sets out data protection obligations which all organizations are required to comply with in undertaking activities relating to the collection, use or disclosure of personal data. A failure to comply with any of the above may subject (i) an organization to a fine of up to 10% of an organization’s annual turnover in Singapore or S$1 million (approximately US$756,773), whichever is higher, or (ii) an individual to a fine of up to S$200,000 (approximately US$143,419). A facilities management operator and/or an artificial intelligence technology company is required to comply with the PDPA, which generally requires organizations to give notice, obtain consent and inform individuals of the applicable purposes prior to collection, use or disclosure of personal data (being data, whether true or not, about an individual who can be identified from that data or from that data and other information to which organizations have or are likely to have access), and to provide individuals with the right to access and correct any error or omission in their personal data. Organizations are also required to put in place sufficient measures to protect the personal data in its possession or control from unauthorized access, loss or damage. On March1, 2024, the Personal Data Protection Commission issued the Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems, which provides specific guidance on how the PDPA applies in three typical stages of artificial intelligence system implementation. Pursuant to the Personal Data Protection Commission’s Advisory Guidelines on the PDPA for NRIC and other National Identification Numbers which took effect on September 1, 2019, an organization is not permitted to collect, use or disclose an individual’s identification number unless (i) the collection, use or disclosure is required by the law, or (ii) it is necessary to establish or verify an individual’s identity to a high degree of accuracy. The PDPA also imposes various baseline obligations on organizations in relation to the permitted uses of, the accountability for, the accuracy of, the protection of, the retention of, and overseas transfers of, personal data. In addition, the PDPA requires organizations to check the “Do Not Call” registers prior to sending marketing messages addressed to Singapore telephone numbers, through telephone calls, text messages or faxes. In the event of a data breach involving any