TL;DR

• The PDPA’s Protection Obligation is outcome-based: the PDPC does not mandate specific technology, but it does expect organizations to show reasonable administrative, physical and technical safeguards matched to the sensitivity and volume of data held.

• Access control is one of the most concrete things an SME can act on this week: shared drive permissions, external sharing settings and MFA enforcement in the Google Workspace Admin console.

• Offboarding delay is one of the most common, avoidable gaps. An employee with lingering access to a shared drive after their last day is a risk that grows with every day the access stays.

• A suspected data breach must be assessed within 30 calendar days. It is notifiable if it is likely to cause significant harm to individuals, or if it affects 500 or more individuals. The PDPC must be notified as soon as practicable and no later than 3 calendar days after the organization decides it is notifiable.

• Automated joiner/leaver provisioning does not make a company PDPA-compliant by itself, but clear access records make an audit or a breach investigation faster and more defensible.

About the Author: This article is written by the ShiftControl team. ShiftControl was built by ex-ExpressVPN operators and is purpose-built for Google Workspace, for companies that run IT without a dedicated IT team.

What Does the PDPA’s Protection Obligation Actually Require?

Section 24 of the PDPA requires organizations to protect personal data in their possession or control by making reasonable security arrangements. These arrangements must guard against unauthorized access, collection, use, disclosure, copying, modification or disposal of personal data, and against the loss of any storage medium or device on which it sits.

The PDPC does not hand SMEs a list of required software. Instead, it uses an outcome-based standard: measures should be “reasonable” given the amount and sensitivity of data you hold. A two-person startup with a spreadsheet of 50 customer emails faces a different bar than a 200-person company running payroll and health records through Google Workspace. Both are in scope. Neither gets to skip the obligation because they lack an IT department.

Organizations decide what is reasonable for the data they hold, and that flexibility means SMEs can’t point to a checkbox and call it done. The evidence has to hold up if the PDPC asks.

Penalties are not symbolic. Non-compliance can draw financial penalties of up to 10% of annual Singapore turnover for organizations whose Singapore turnover exceeds S$10 million, or up to S$1 million otherwise. The PDPC publishes its enforcement decisions, and many involve basic access-control lapses (PDPC enforcement decisions).

What Do “Reasonable Security Arrangements” Look Like for Access Control Specifically?

Access control is where the Protection Obligation stops being abstract. If personal data is stored in Google Workspace, “reasonable security arrangements” means controlling exactly who can open it, from where and for how long.

Four areas carry the most weight in practice:

• Shared drive membership. Any shared drive holding customer records, HR files or contracts should have a defined member list, not an open “anyone with the link” setting. Admins should know, by name, who has edit versus view access.

• External sharing settings. The Google Workspace Admin console lets you set sharing defaults at the organizational-unit level, restricting external sharing entirely or limiting it to approved domains. For SMEs handling personal data, the default should not be “on” for the whole organization.

• Offboarding speed. Access that survives an employee’s last working day is one of the easiest gaps to point to after an incident. Google Workspace admin revocation needs to happen on the day someone leaves, not whenever HR remembers to flag it.

• MFA enforcement. Google Workspace MFA can be enforced at the organizational-unit level, meaning you can mandate it for every account touching sensitive drives without relying on individual employees to opt in.

Think of access control the way you’d think of key management for a physical office with a filing room. It’s not enough that the building has a lock. You need to know who was issued a key, which keys still work and whether anyone who left the company six months ago can still walk in. Google Workspace gives you the equivalent of a digital key register, provided someone actually maintains it.

Role-based access control (RBAC) is the mechanism that keeps this manageable as a company grows past a handful of staff. Instead of granting access file-by-file, RBAC ties access to a role or group (finance, HR, customer support), so a new hire in a given role inherits exactly the permissions that role needs, and nothing more. This also supports a related PDPA expectation: data minimization. An employee who doesn’t need access to the customer database for their job shouldn’t have it, and RBAC is the structural way to enforce that rather than relying on manual judgment calls.

What Does a Practical Google Workspace Checklist Look Like?

Here is a working checklist an SME can run through:

Google secures the underlying infrastructure, and its documentation describes the controls it runs on its own production systems. Configuring who can access what in your Workspace is your responsibility. The settings exist. The gap for most SMEs is maintaining them as headcount changes.

Shadow IT discovery deserves a specific mention here. Many SMEs don’t actually know which third-party apps employees have connected to their Google Workspace account via OAuth, each with its own scope of access to email, Drive or Calendar data. A permissions review (Security > API controls) will often surface forgotten integrations with broader access than anyone intended, a direct Protection Obligation gap if any of those apps touch personal data.

What Should an SME Do If Personal Data Is Exposed?

Day-to-day access hygiene is one half of the picture. The other half is what happens when something goes wrong. Under the PDPA, an organization that suspects a data breach must assess it within 30 calendar days. A breach is notifiable if it is likely to cause significant harm to individuals, or if it affects 500 or more individuals. The organization must notify the PDPC as soon as practicable and no later than 3 calendar days after deciding the breach is notifiable. Where there is significant harm, it must also notify affected individuals as soon as practicable. The full process is in the PDPC guide on managing and notifying data breaches, and getting the judgment right is exactly the kind of situation where specific legal advice matters. This article is not a substitute for that advice.

What you can prepare in advance is the operational side: knowing who in your organization has authority to make the notification call, having a documented incident response process and having a clear record of who had access to the affected data and when. That last point is where access logs become more than a compliance nicety. During a breach investigation, being able to show exactly when an employee’s access was granted and revoked can be the difference between a contained incident and an open question the PDPC has to chase down.

How Does Automated Joiner/Leaver Access Support the Protection Obligation?

Manual offboarding is a common place the Protection Obligation quietly fails. A departing employee’s Google Workspace account is suspended, but a shared drive they had direct access to, or a third-party app connected via personal OAuth grant, often isn’t touched because no single person owns that task list.

With ShiftControl, Google Workspace access is set up and removed automatically. Everything else runs as a guided task list for the app owner. ShiftControl syncs with HRIS platforms such as BambooHR, Deel, Gusto, HiBob and Rippling, and uses dynamic group rules to assign apps and group membership by role, department or location. You can export app assignments and authorization history as audit evidence.

This doesn’t make a company PDPA-compliant on its own, and a Data Protection Officer in Singapore still needs to assess whether the organization’s broader data handling practices meet the Protection Obligation. What automated provisioning does is remove the Google Workspace side of that failure point.

Frequently Asked Questions

Does every Singapore SME need a Data Protection Officer?

Yes. The PDPA requires every organization to designate at least one individual, usually called the Data Protection Officer, to be responsible for its compliance. That person does not need to be a Singapore resident or citizen, though the PDPC recommends they be contactable from Singapore during business hours. The role can be held part-time by a founder or operations lead rather than a dedicated hire.

Does the PDPA require specific technology like encryption or MFA?

No. The PDPA is outcome-based and does not mandate specific tools. It expects reasonable security arrangements appropriate to the risk, and PDPC enforcement decisions often involve basic access-control lapses such as weak passwords or unsecured access.

Can personal data be stored on servers outside Singapore?

Yes. The PDPA does not impose data residency requirements, but the Transfer Limitation Obligation requires that any overseas recipient of the data provides a standard of protection comparable to the PDPA, typically through contracts, binding corporate rules or recognized certifications.

How fast should access be removed when an employee leaves?

The PDPA doesn’t set a specific hour or day, but reasonable practice is same-day removal of Google Workspace and connected app access. The longer the gap, the higher the risk.

Is Google Workspace itself PDPA-compliant?

Google Workspace provides security and compliance controls that support an organization’s own Protection Obligation efforts, but compliance is a property of how an organization configures and manages its data, not something a platform grants automatically.

Does ShiftControl make a company PDPA-compliant?

No single tool does. ShiftControl sets up and removes Google Workspace access automatically, shows you every app and OAuth scope connected to your Workspace and lets you export app assignments and authorization history you can use as evidence in a Protection Obligation assessment. Compliance decisions rest with the organization. The PDPA has no certification requirement, though IMDA’s Data Protection Trustmark (DPTM) is a voluntary certification.

If your organization is working through its Protection Obligation requirements, talk to a Data Protection Officer or legal advisor about your specific situation.

About ShiftControl

ShiftControl is purpose-built for Google Workspace, for companies that run IT without a dedicated IT team. Google Workspace access is set up and removed automatically when someone joins, moves or leaves, and everything else runs as a guided task list for the app owner. You can see every app and OAuth scope connected to your Workspace and track SaaS spend and renewals. You can also export app assignments and authorization history as audit evidence. Cyber incident response (IR-1, via Blackpanda) is included in every subscription. ShiftControl is SOC 2 Type 2 compliant, ISO 27001 certified and signed the CISA Secure by Design Pledge in 2024. Setup takes as little as 10 minutes with a Google Workspace admin sign-in.

Start a 14-day free trial, no credit card required.

References

1. Cloud security and data protection services | Google Workspace (workspace.google.com)

2. How Google protects your organization’s security and privacy | Legal & compliance | Google Workspace Help (knowledge.workspace.google.com)

3. PDPC enforcement decisions (pdpc.gov.sg)

4. Guide on Managing and Notifying Data Breaches under the PDPA (pdpc.gov.sg)

5. Personal Data Protection Act 2012, section 11 (designating a Data Protection Officer) (sso.agc.gov.sg)

6. Personal Data Protection Act 2012, section 48J (financial penalties) (sso.agc.gov.sg)