Data Protection Complaints Process

How to raise a concern about the way DSN handles your personal data

This process should be read together with the TheDiscerning.One Privacy Policy. It applies to data protection complaints concerning Discerning Solutions (S) Pte Ltd ("Discerning Solutions", "DSN", "we", "us" or "our").

1. Your right to raise a data protection concern

If you believe that DSN has collected, used, disclosed, retained, transferred, protected or otherwise handled your personal data inappropriately, you may raise a concern with our Data Protection Officer ("DPO").

We take data protection concerns seriously and seek to review them fairly, proportionately and in accordance with applicable law. Raising a complaint does not require you to use legal terminology or identify a specific provision of the law.

2. Who can raise a concern

You may use this process if DSN processes or handles personal data about you. This may include, for example:

• a current, former or prospective client contact;

• a research, interview, survey, workshop or diagnostic participant;

• a supplier, partner, contractor or practitioner;

• a website visitor, event attendee or briefing subscriber;

• a job applicant or other professional contact; or

• any other individual whose personal data is handled by DSN.

3. What can you raise with us?

A data protection concern may relate to matters such as:

• personal data collected without a clear or appropriate purpose;

• personal data that you believe is inaccurate or incomplete;

• unauthorised or unexpected access, use or disclosure;

• a suspected loss, exposure or security incident involving personal data;

• retention of personal data that you believe is no longer required;

• overseas processing or transfer of personal data;

• the use of personal data in an AI-supported process;

• difficulty exercising access, correction or withdrawal-of-consent rights; or

• another concern about how DSN has handled your personal data.

This process is specifically for data protection concerns. Commercial disputes, disagreement with a DSN method judgment, contractual disputes or other non-privacy matters may be handled through the relevant engagement or another applicable process.

4. How to contact DSN

Please send your concern to: ask.us@thediscerning.one

5. What information should you provide?

You do not need to provide more personal data than is reasonably necessary. Where possible, please tell us:

• your name and a way for us to contact you;

• what happened and what your concern is;

• when you became aware of the issue;

• the personal data or interaction involved, where known;

• any relevant correspondence, screenshots or supporting information;

• whether the issue may still be ongoing; and

• what clarification, correction or outcome you are seeking.

Please avoid sending unnecessary sensitive or confidential information merely to demonstrate that a concern exists. 

We may ask for further information if it is reasonably required to understand or investigate the matter.

6. What happens after we receive a complaint?

6.1 Acknowledgement

We aim to acknowledge a data protection complaint within 3 business days.

Our acknowledgement should tell you who is handling the matter, what will

happen next, whether we need further information and when you can expect

the next substantive update.

6.2 Triage and immediate protection

We first assess the nature and urgency of the concern. If the complaint

indicates possible unauthorised disclosure, loss, compromised credentials,

active misuse, a security incident or another potential data breach, DSN may

immediately escalate the matter through its incident-response process and

take containment or protective measures before the ordinary complaint

review is complete.

6.3 Investigation

The scope of an investigation will depend on the issue. Where relevant, DSN may review:

• what personal data was involved;

• how and why it was collected or received;

• the authorised purpose and relevant notices or consents;

• the source, provenance or accuracy of the information;

• who or what systems accessed, used or received it;

• whether an approved service provider or partner was involved;

• whether an AI-supported system materially contributed to the activity;

• relevant retention, deletion or transfer records;

• security and access controls; and

• any relevant Decision Record information, while protecting unrelated confidential information and the rights of other people.

We will seek to limit the investigation to information reasonably necessary to understand the issue and determine what action, if any, is required.

6.4 Substantive response

We aim to provide a substantive response within 10 business days of receiving a sufficiently clear complaint. Where reasonably possible, our response will:

• address the material points you raised;

• explain what we found;

• state whether the concern is upheld, partly upheld or not upheld, where that classification is appropriate;

• describe corrective or remedial action taken or planned, where appropriate; and

• explain the basis of our conclusion where the complaint is not upheld.

Some matters may take longer because of their complexity, the need to obtain records or information from third parties, legal restrictions, security investigations or other reasonable causes. If this happens, we will seek to explain the reason for the delay and provide an updated expected response date.

7. Access and correction requests

If your complaint includes a formal request to access or correct your personal data, that part of your request will be handled under the applicable PDPA access and correction requirements and the relevant provisions of our Privacy Policy.

Access and correction requests are not converted into ordinary complaints merely to apply the 10-business-day service target above. DSN will handle them according to the timelines and requirements applicable to those statutory requests. Where applicable, if DSN cannot complete an access or correction request within the period prescribed by law, we will provide the required written notice of the expected response time.

8. What if you are not satisfied?

We encourage individuals to give DSN a reasonable opportunity to clarify, investigate and resolve the matter directly. If you remain dissatisfied after doing so, you may raise the matter with the Personal Data Protection Commission of Singapore ("PDPC") or another competent authority where applicable.

For Singapore personal data protection concerns, you can refer to the PDPC's Report a Personal Data Protection Concern process.

Nothing in this process removes or limits any right you may have under applicable law.

9. How we handle information about the complaint

Information provided in a complaint may itself contain personal or confidential information. DSN will use complaint information for purposes reasonably connected with receiving, investigating, resolving, documenting or learning from the concern, and for complying with legal, regulatory, security or contractual obligations.

Access to complaint information should be limited to people, systems, advisers, service providers or authorities whose involvement is reasonably necessary for those purposes. Where possible, DSN will avoid reproducing or circulating more personal data than the investigation requires.

10. Learning and remediation

A complaint is not treated only as a case to close. Where a concern reveals a material weakness in DSN's controls, technology, provider arrangements, training, process or governance, DSN will consider what should change to reduce the likelihood of recurrence.

Depending on the circumstances, action may include correcting data, restricting or removing access, changing a process, deleting or de-identifying information, improving security, revising notices or consent practices, changing an AI workflow, reviewing a provider, updating training or strengthening an internal control.

11. Our commitment

DSN is committed to:

• treating data protection concerns fairly and seriously;

• responding promptly and keeping complainants appropriately informed;

• protecting personal data during the complaint process;

• maintaining identifiable accountability for the investigation and outcome;

• taking proportionate remedial action where a concern is substantiated; and

• learning from complaints to improve our practices.

12. Closing principle

Raise the concern. Establish what happened. Correct what should change.

Preserve what must be learned.