BCP - Basic Insurance Concepts and Principles Singapore Data Protection and Hygiene Questions and Answers

Question 1

A financial adviser representative stores digital copies of clients' application forms, which include NRIC numbers and health declarations, on a personal, unencrypted laptop.
If this laptop is stolen, which primary obligation under Singapore's Personal Data Protection Act (PDPA) has been breached?

Accepted Answer

The Protection Obligation, as reasonable security arrangements were not made.

Answer

The Consent Obligation, as clients did not consent to storage on a personal device.

Answer

The Accuracy Obligation, as the data may become outdated.

Answer

The Retention Limitation Obligation, as the data should have been deleted immediately.

Question 2

To comply with the accountability principle under Singapore's Personal Data Protection Act (PDPA), what must every insurance agency, regardless of its size, do?

Accepted Answer

Appoint at least one individual as a Data Protection Officer (DPO).

Answer

Encrypt all email communications with clients using military-grade encryption.

Answer

Conduct a third-party data security audit every financial year.

Answer

Register all their data processing activities with the Personal Data Protection Commission (PDPC).

Question 3

An insurance company obtains a list of phone numbers from a third-party vendor to market a new retirement plan. To comply with the Do Not Call (DNC) provisions of the PDPA, which action is mandatory before making unsolicited telemarketing calls?

Accepted Answer

Check the numbers against the national DNC Registry and only call those not listed.

Answer

Assume consent is given as the numbers were purchased from a reputable vendor.

Answer

Call the numbers but provide an option to opt-out during the first 30 seconds of the call.

Answer

Send a preliminary SMS to each number to request consent for a call.

Question 4

Mr. Tan provides his personal data to an insurance agent for the sole purpose of obtaining a quotation for a car insurance policy. A week later, the agent adds Mr. Tan's email to a monthly newsletter mailing list for investment-linked products. Which PDPA obligation has the agent most likely breached?

Accepted Answer

The Purpose Limitation Obligation.

Answer

The Access Obligation.

Answer

The Correction Obligation.

Answer

The Data Portability Obligation.

Question 5

An insurer in Singapore discovers a cyber-attack has resulted in the unauthorised access of the NRIC numbers and policy details of 1,200 clients. According to the PDPA's mandatory data breach notification requirements, what is the insurer's primary obligation?

Accepted Answer

Notify the affected individuals and the Personal Data Protection Commission (PDPC).

Answer

Offer complimentary credit monitoring to all affected individuals before notifying any authorities.

Answer

Immediately publish a notice of the breach on their corporate website without delay.

Answer

Notify only the Monetary Authority of Singapore (MAS) within 72 hours.

Question 6

A client's life insurance policy with ABC Insurer lapsed five years ago. Under the PDPA's Retention Limitation Obligation, when should ABC Insurer cease to retain the client's personal data?

Accepted Answer

When retention no longer serves the original purpose and is not necessary for legal or business purposes.

Answer

Immediately upon the policy lapsing to minimise data risk.

Answer

Only after receiving a written request for deletion from the former client.

Answer

Exactly seven years after the policy lapse date, to align with general accounting practices.