A consent banner is the visible tip of a much larger requirement. Under PDPA you must record what a data subject agreed to, when, for which purpose, and be able to honour a withdrawal later. We model consent as first-class records linked to every personal-data field, so the lawful basis for holding a value is always queryable — not buried in a log nobody reads.
Personal data has an expiry. We attach retention policies at the schema level so records carry their own deletion schedule, and erasure requests cascade through derived copies, caches, and backups rather than leaving orphaned fragments. Designing this early is cheap; retrofitting deletion into a system that assumed data was permanent is one of the most expensive migrations a team can face.
PDPA expects that only people with a legitimate need can see personal data. Role-based access alone is too coarse, so we combine RBAC with record-level ACLs and full audit trails. Every read of sensitive data is attributable, which both satisfies regulators and shrinks the blast radius when an account is compromised.