PDPA and cyber security for condominiums (MCSTs) and managing agents
We work across sectors. Here is what matters most in yours.
The 3 most recent PDPC decisions in your sector
2026-05-07 · Directions
A condominium had no DPO, no policies and no checks on its managing agent’s handling of data.
Lesson: Appointing a managing agent does not hand over your accountability.
Read the PDPC decision of 7 May 2026, on pdpc.gov.sg (opens in a new tab)2025-08-07 · Voluntary undertaking
A resident’s request for CCTV footage of themselves was refused.
Lesson: Treat a request for CCTV footage as a PDPA access request.
Read the PDPC decision of 7 August 2025, on pdpc.gov.sg (opens in a new tab)2025-08-07 · Directions
A condominium had no data protection policies or practices.
Lesson: Write your policies and practices down, and use them.
Read the PDPC decision of 7 August 2025, on pdpc.gov.sg (opens in a new tab)
Source: PDPC Case Library, read 12 October 2026.What PDPC decisions show
Where organisations like yours are most often exposed
The gap areas our free check asks about most for your sector.
- CCTV notices and footage requests not handled to PDPACCTV footage is personal data. Missing notices and loose access are common findings.How we help: Policies, notices and consent
- NRIC numbers or copies collected without needCollecting NRIC numbers without need adds risk you do not have to carry.How we help: Policies, notices and consent
- Managing agent not overseen by the MCSTThe MCST stays accountable even when a managing agent runs the estate.How we help: Named Data Protection Officer
- No written data protection policiesWithout written data protection policies, a single complaint can turn into a PDPC finding.How we help: PDPA implementation, turnkey
Certificates that most often fit your sector
From every answer path of our “Which certification fits?” questions for your sector. Side by side, as choices.
In our clients’ words
“Their review of the resident forms alone demonstrated the value of the engagement, as several forms were collecting personal data without being fully aligned with PDPA requirements.”
Common questions
Does an MCST need a data protection officer?
Yes. The MCST must appoint a data protection officer and have its own policies. The Personal Data Protection Commission (PDPC) confirmed in its 2026 MCST 4869 decision that the managing agent does not take over that accountability.
Can our managing agent be the DPO?
The agent can help, but the MCST stays accountable. A DPO independent of the agent can check the agent’s practices on the MCST’s behalf. In MCST 4869, leaving everything to the agent was part of the problem.
What does the PDPA mean for condo CCTV?
CCTV footage is personal data. Put notices at entry points, limit who can view footage, and have a procedure for residents’ footage requests. MCST 3615’s undertaking included a CCTV protocol.
Can we collect NRIC numbers from visitors?
Generally not in full. PDPC guidelines limit collecting NRIC numbers to cases the law requires or where identity must be verified to a high degree. Most visitor logs can use other details.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your council or managing agent (PDF, 68 KB)