Managing personal data (PDPA)

Are companies responsible for their employees who do not comply with the PDPA?

Yes. However, the organization will not be liable if it took such steps as were practicable to prevent the employee from doing the act or engaging in the conduct that constitutes the offence. Please note that an “employee” includes a volunteer under the PDPA (section 2).