PDPPL data sharing: what NCSA's new checklist means for your vendors
In May 2026, NCSA's Personal Data Privacy Protection Department published a checklist for sharing personal data. Here is how an SME can put it to work.
Last reviewed: 2026-10-18
What was published
On 24 May 2026, NCSA launched the "Personal Data Sharing Checklist for Regulated Entities", announced by its Personal Data Privacy Protection Department (PDPPD). According to The Peninsula, it is a framework to help organisations identify lawful bases for sharing personal data, assess the risks, implement appropriate security measures, and safeguard individuals' rights throughout the sharing process. It sets out controls for before, during and after sharing, and is available on the PDPPL Guidance Hub on NCSA's website (The Peninsula, 25 May 2026).
Who it's relevant to
Any organisation subject to the PDPPL that passes personal data to someone else: a booking platform, payment processor, marketing agency, CRM, IT support provider, delivery partner or group company. The law already requires controllers to check that disclosures to processors fit Lawful Purposes and to verify processors' compliance.
Step 1: map your data flows
List each recipient, the data shared, the purpose and the transfer method (API, upload, email). Include tools your website loads, such as analytics, chat and ad pixels, because they receive visitor data too.
Step 2: checks before sharing
- A lawful basis and a defined purpose for the share
- Minimum necessary data
- The recipient's security measures reviewed
- A contract covering instructions, security and prompt breach notice
Step 3: controls during and after
- Encrypted transfer; access limited to named staff
- Periodic review of whether the share is still needed
- Return or deletion when the relationship ends
- A route for passing on individuals' access and deletion requests
A simple vendor register
| Vendor | Data shared | Purpose | Contract/DPA | Security reviewed | Next review |
|---|---|---|---|---|---|
| e.g. booking platform | Name, phone, email, party size | Reservations | Yes (date) | Yes (date) | Quarterly |
Download the official checklist from NCSA's PDPPL Guidance Hub and use it alongside this register.
This article is for general educational purposes and is not legal advice. Seek qualified counsel for your specific situation.
Find out what your website reveals
Run the free passive mini-scan in under a minute, or ask for a quote for the full report.