| name | singapore-pdpa-expert |
| title | Singapore - Personal Data Protection Ac (PDPA) (2012) Expert |
| description | Singapore - Personal Data Protection Ac (PDPA) (2012) expert. Reference-depth framework plugin with assessment, scope determination, and evidence checklist — backed by the SCF crosswalk. Level up to Full by adding framework-specific workflow commands. |
| author | GRCEngClub |
| author_url | https://github.com/GRCEngClub/claude-grc-engineering/tree/main/plugins/frameworks/singapore-pdpa/skills/singapore-pdpa-expert |
| license | MIT |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | sg |
| practice | data-protection |
| language | en |
Singapore - Personal Data Protection Ac (PDPA) (2012) Expert
Reference-depth expertise for Singapore - Personal Data Protection Ac (PDPA) (2012). This plugin bundles the SCF crosswalk (30 SCF controls → 14 framework controls) with framework-specific context.
Framework identity
- SCF framework ID:
apac-sgp-pdpa-2012
- Region: APAC
- Country: SG
TODO: add the following when filling in expertise. Reference depth expects all of these to have at least two-sentence answers.
Framework in plain language
TODO: one-paragraph summary of what Singapore - Personal Data Protection Ac (PDPA) (2012) exists to do and who it affects. Avoid verbatim regulation text — paraphrase and cite articles/sections by number.
Territorial scope and applicability
TODO: who must comply, where operations must be happening, what the carve-outs are.
Mandatory artifacts
TODO: the named documents or registers the framework requires (e.g. GDPR's ROPA/DPIA, PCI DSS's ROC/SAQ, ISO 27001's Statement of Applicability). Stub if uncertain; a Full-depth PR can add commands to generate each.
Cadence and timelines
TODO: notification windows (e.g. GDPR 72 hours), assessment frequency, recertification cycles.
Regulator and enforcement
TODO: who enforces, how penalties are calculated, recent enforcement patterns worth knowing.
Interaction with other frameworks
TODO: overlaps with GDPR / ISO / NIST / sectoral rules. Reference the cross-framework analyzer outputs when useful.
Common misinterpretations
TODO: at least 2–3 community-level misunderstandings this plugin should correct. Example: "ITAR only affects munitions" (it covers technical data too).
Command routing
/singapore-pdpa:scope — determine applicability/singapore-pdpa:assess — run a gap assessment/singapore-pdpa:evidence-checklist — enumerate evidence requirements
All three delegate to /grc-engineer:gap-assessment with SCF framework ID apac-sgp-pdpa-2012 for the control-by-control mechanics, and wrap the results in Singapore - Personal Data Protection Ac (PDPA) (2012)-specific terminology.
Levelling up to Full
Full-depth plugins add framework-specific workflow commands tied to the audit ritual. Candidates for this framework:
TODO: propose 2–4 framework-specific commands. Examples from existing Full-depth plugins:
