Trying to build a compliance sequence for a mid-size firm. We sit under PECA 2016, the 2021 PTA content rules, and — once passed — the Personal Data Protection Bill. The bill puts a data-protection-officer and breach-notification duty on "data controllers," but PECA 2016 already has a CERT-incident-reporting thread. Where do the two actually converge, and is there a realistic phased plan so we are not forced to rebuild everything the day the bill is gazetted?
Data Protection Bill + PECA 2025 amendment — what binds first for an SME?
Thread digest
By Rahnuma · AI-generated
<h3>Positions</h3><ul><li><b>S. — DataStream Solutions (#1 & #3):</b> Wants a sequenced compliance roadmap so the firm does not face a cliff-edge build on gazettment of the Personal Data Protection Bill. Specifically seeks clarity on where DPO/breach-notification duties under the bill overlap with CERT incident reporting under PECA 2016, and requests a clause-by-clause comparison of the 2023 bill draft versus the 2021 consultation draft, with focus on where SME carve-outs were narrowed.</li></ul><ul><li><b>Anonymous (#2):</b> Proposes a "build the hard part once" architecture — a central audit trail and data map that simultaneously satisfies both the breach-notification duty and CERT reporting. Explicitly defers the cross-border transfer precedence question to the policy team.</li></ul><h3>Where the room agrees</h3><ul><li>Both positions accept that the two regimes — PECA 2016 (including 2021 PTA content rules) and the pending Personal Data Protection Bill — create overlapping but not identical compliance obligations, and that a single data map / audit trail could serve both.</li></ul><h3>Where it's split</h3><ul><li><b>Implementation sequencing:</b> DataStream Solutions wants a phased plan tied to gazettment; Anonymous frames it as an architecture problem ("build once") rather than a sequencing problem. No resolution offered.</li></ul><ul><li><b>Cross-border transfers:</b> Both participants flag this as unresolved; Anonymous states it is "still genuinely unclear" and has referred it to a policy team. No competing positions within the thread — both treat it as open.</li></ul><h3>Open questions</h3><ul><li>Which regime takes statutory precedence on cross-border data transfers.</li><li>Whether a unified audit trail meets the specific evidentiary thresholds of both the CERT-reporting obligation under PECA 2016 and the breach-notification obligation under the bill.</li><li>What the 2023 draft bill changed regarding SME carve-outs compared to the 2021 consultation draft — the document does not exist in the thread.</li></ul><h3>Companies on the record</h3><ul><li><b>DataStream Solutions</b></li></ul>
We are treating it as a "build the hard part once" problem: a central audit trail and a data-map that serves both the breach-notification duty and the CERT reporting. The sequencing question you raise is the same one we keep asking the policy team — which regime takes precedence on a cross-border transfer is still genuinely unclear.
Following up on my own post: if anyone has a clause-by-clause comparison of the 2023 draft versus the 2021 consultation draft highlighting where the SME carve-outs shrank, please drop it here. That is the document we are missing internally.
Sign in to join this discussion — one click, email only.