What this guideline covers
The Cyber and Data Protection (Licensing of Data Controllers) Guideline, CDPG 1 of 2025, is issued by POTRAZ and is read together with Statutory Instrument 155 of 2024. It sets out how organisations that process personal data apply for and hold a data controller licence.
What "processing" means
Processing covers any operation performed on personal data, whether or not by automated means. The guideline lists operations such as: collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, disclosure, dissemination, combination, restriction, erasure and destruction.
Who counts as a data subject
A data subject is any identified or identifiable person whose personal data is processed. Data subjects can include employees, daily walk-in visitors, members or clients, service providers, suppliers, website visitors, and other people whose personally identifiable information is processed.
Licensing is not limited to customer databases
Many organisations assume licensing only applies to customer or client databases. The guideline makes clear that employees, visitors, members, suppliers and website users may all count. If you process personal data about any identifiable person, the Act likely applies to you.
Four licence categories
The regulations provide for four licence categories. The applicable category depends on the relevant schedule and the current threshold bands, which are set out in the schedule under the regulations. Choose the licence category that matches the current schedule. If you are unsure, confirm the current threshold band before submission.
Exemptions
Exemptions must be checked against the governing law and regulations. Do not assume your organisation is exempt because of its size or sector. Where an exemption might apply, confirm it against the Act and S.I. 155 of 2024 before relying on it.
Verify before you file
Confirm the current official form and schedule with POTRAZ before filing. The guideline should be read together with S.I. 155 of 2024. Licensing decisions rest with POTRAZ, and no outcome is promised by this resource.