Company: OTSA
Filing Date: 2025-07-07
Form Type: F-1/A
Source: 0001213900-25-061733
Chunk: 207

Company: OTSAW Ltd
Filing Date: 2025-07-07
Form: F-1/A
Chunk 207
---
 to put in place sufficient measures to protect the personal data in its possession or control from unauthorized access, loss or damage. On March1, 2024, the Personal Data Protection Commission issued the Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems, which provides specific guidance on how the PDPA applies in three typical stages of artificial intelligence system implementation. Pursuant to the Personal Data Protection Commission’s Advisory Guidelines on the PDPA for NRIC and other National Identification Numbers which took effect on September 1, 2019, an organization is not permitted to collect, use or disclose an individual’s identification number unless (i) the collection, use or disclosure is required by the law, or (ii) it is necessary to establish or verify an individual’s identity to a high degree of accuracy. The PDPA also imposes various baseline obligations on organizations in relation to the permitted uses of, the accountability for, the accuracy of, the protection of, the retention of, and overseas transfers of, personal data. In addition, the PDPA requires organizations to check the “Do Not Call” registers prior to sending marketing messages addressed to Singapore telephone numbers, through telephone calls, text messages or faxes. In the event of a data breach involving any personal data in an organization’s possession or control, the PDPA requires the organization to take reasonable and expeditious steps to assess whether the data breach is notifiable under the Personal Data Protection Commission, and the organization is required to notify the Personal Data Protection Commission of the data breach if it is assessed to be one that: (i) results in, or is likely to result in, significant harm to an affected individual, or (ii) is, or is likely to be, of a significant scale. In addition to notifying the Personal Data Protection Commission, organizations are also required to notify the affected individuals of notifiable data breaches in any manner that is reasonable in the circumstances. 127 Consumer Protection There are various general consumer protection laws in place in Singapore, which apply generally to all relevant transactions but are not specifically targeted at regulating facilities management and/or artificial intelligence technology operations. One or more of these laws would be relevant in the context of regulating facilities management and/or artificial intelligence technology operations. The Consumer Protection (Fair Trading) Act 2003 of Singapore (“CPFTA”) sets out a legislative framework to allow consumers aggrieved by unfair practices to have recourse to civil remedies before the Singapore courts. The definition of “supplier” under the CPFTA includes persons who provide goods or services to consumers, or