# PDPA Checklist for a Jewellery Shop — One Page
**GJPA free template · v0.9 (demonstration)** — the five obligations from the PDPC, translated to a jewellery shop's real workflows (repairs, custom orders, VIP clienteling, marketing). Not legal advice; see pdpc.gov.sg.

## 1 · Consent & notification
- [ ] Repair/custom-order forms state **why** you collect NRIC/phone/photos of items
- [ ] Point-of-sale and online checkout carry a privacy notice link
- [ ] No using data for new purposes without fresh consent (e.g., purchase list → marketing: separate opt-in)

## 2 · Do Not Call (DNC)
- [ ] Check phone numbers against the DNC Registry **before** any call/SMS marketing campaign
- [ ] Keep evidence of clear, unambiguous consent where a customer opted into marketing
- [ ] Every marketing message identifies the sender and offers an opt-out

## 3 · Data Protection Officer (DPO)
- [ ] A DPO is designated (may be a staff member wearing two hats) and **contactable publicly** (site/footer/form)
- [ ] Staff know who the DPO is and route access/correction requests there within 30 days

## 4 · Breach notification
- [ ] Written internal procedure: assess → notify PDPC within **3 calendar days** if significant harm or ≥500 individuals affected → notify affected individuals
- [ ] Contact-list/CRM access on a need-to-know basis; unique logins; no shared passwords

## 5 · Protection & retention
- [ ] CCTV, client books, gem photos and appraisal records stored securely (locked drawer, access-controlled cloud)
- [ ] Retention rule written down (e.g., CDD records kept 5 years per AML law — deleted when purpose expires thereafter)
- [ ] Supplier contracts (photographers, setting jobbers, couriers) include data-protection clauses

**Jewellery-specific traps:** heirloom-photography consent; minors' data in ear-piercing/first-piercing workflows; VIP clienteling notes are personal data too.