The PDPA amendments are in force. The obligations are not onerous individually; the problem is that several of them require infrastructure that takes longer than the deadline to build.
The 72-hour clock
Notification to the Commissioner within 72 hours of becoming aware of a breach. Affected individuals within seven days where there is a risk of significant harm.
Seventy-two hours is not long enough to decide whether you have a breach if you have not already decided what one looks like. That determination has to be made in advance.
Processors are now directly liable
Previously only data users carried obligations. Processors — anyone handling personal data on someone else's instruction — now have their own, including security obligations enforceable against them directly.
The DPO
Appointment must be notified to the Commissioner within 21 days, and the contact address published on a public channel.