No One Is Exempt: Why MCSTs Must Have Their Own DPO and Policy

Many MCSTs assume their managing agent’s PDPA policy covers them — this case proves otherwise.

When the Personal Data Protection Commission (PDPC) released its decision against a condominium’s Management Corporation Strata Title (MCST), it revealed a familiar yet costly misunderstanding:

The MCST believed its managing agent’s PDPA policy and practices were sufficient.

They were not.

The Finding: Accountability Can’t Be Outsourced

In the case, the PDPC found that the MCST did not appoint a Data Protection Officer (DPO) and had no internal data protection policy. While the managing agent had its own PDPA procedures, the MCST itself — as the legal entity collecting and using residents’ personal data — remained accountable.

This distinction is crucial:

• The managing agent acts as a data intermediary, processing data on the MCST’s behalf.
• The MCST, however, is the data controller — the one who determines why and how personal data is collected.

That means the MCST cannot delegate accountability under the PDPA, even if day-to-day tasks are handled by the agent.

The PDPC’s message was clear:

“Delegation does not transfer responsibility.”

What Went Wrong

The MCST had no formal DPO appointment or documented policy. Staff and council members relied on the managing agent’s practices and verbal assurances. When a data incident occurred, there were no clear procedures, no point of contact for PDPA matters, and no evidence of internal oversight.

This lack of governance exposed the MCST to enforcement action and reputational risk — something that could have been avoided with a few simple steps.

What Every MCST Should Do Now

Here’s a practical checklist to ensure your MCST is compliant and confident:

1. Appoint a Data Protection Officer (DPO)

• The DPO can be a council member, the managing agent, or an external service provider.
• Record the appointment formally in the meeting minutes.
• Publish the DPO’s contact details on your condo notice board or website.

2. Develop a Simple Data Protection Policy

• Outline how personal data (e.g. resident contact details, CCTV footage, access card records) is collected, used, and protected.
• Include data retention periods and breach reporting procedures.
• Make the policy available to residents upon request.

3. Brief Your Managing Agent and Vendors

• Ensure contracts clearly state the agent’s role as a data intermediary.
• Require vendors (CCTV, security, IT) to follow your PDPA policy and report any breaches immediately.
• Conduct an annual review to ensure compliance remains up to date.

4. Train Council Members and Staff

• Basic awareness of PDPA obligations prevents accidental breaches.
• A short annual briefing can go a long way toward ensuring everyone knows their role.

Don’t Let This Happen to Your Condo

PDPA compliance isn’t just for big corporations — every MCST is a legal entity, accountable for the personal data it holds. The good news? Compliance doesn’t have to be complicated.

Appoint a DPO.

Write down your policy.

Brief your vendors.

These three steps can save your council from unnecessary fines — and even more importantly, build trust with your residents.

Bottom Line

If you’re part of an MCST council, ask this today —

✅ Who is our DPO?

✅ Where is our data protection policy?

If the answer is silence, it’s time to act.

Reference

This article draws on the PDPC’s published decision on 7 Aug 2025, where the Commission found that the MCST had failed to appoint a DPO and lacked an internal data protection policy.

Read the full decision on the PDPC website.

‍