PDPA now expects a named person and a 72-hour clock. Most SMEs have neither

The Personal Data Protection (Amendment) Act 2024 changed two things that matter to a company of fifteen people: someone now has to be named as responsible for data protection, and a breach now has to be reported rather than quietly fixed.

The officer is the easy part to get wrong

Appointing a data protection officer is not hard. Appointing one who can do the job is, because the role only works if that person can get answers. In most SMEs the honest answer to “where is our customer data?” is a list nobody has written down: the CRM, the accounting system, a shared drive, two laptops, one WhatsApp group and whatever the previous web developer left running.

A named officer with no inventory is a compliance document, not a control. The first useful week of that role is spent making the list.

72 hours is shorter than it sounds

Breach notification runs on a clock that starts when you become aware, not when you finish investigating. That is the part that catches people. To notify meaningfully you need to state what data, whose data, and how much, within three days, while also containing the incident.

Every one of those questions is answerable in advance and nearly impossible to answer under pressure. Which is the argument for doing the boring work now:

• A written inventory of what personal data you hold and which system holds it.
• Logging that can actually show what was accessed, retained long enough to be useful. Logs that roll over weekly cannot answer a question asked on day three.
• One named person who decides whether something is a breach, and a deputy for when that person is on leave.
• A tested backup: one you have actually restored from, not one that reports success.

What this is not

It is not a reason to buy a platform. Most of what the amendment asks for is organisational: knowing what you hold, deciding who is accountable, and being able to reconstruct events. Tooling helps with the third one and cannot substitute for the first two.

If someone is selling you PDPA compliance as a product licence, ask them which of the four items above it produces.