Under Singapore’s Personal Data Protection Act (PDPA), organisations must make reasonable security arrangements for the protection and disposal of personal data.