This review examines the decisions issued in the year 2020 by the Personal Data Protection Commission (“PDPC”), that relate to the regulation of data collection, use and disclosure. The focus is on those data protection obligations in the Personal Data Protection Act 2012 (“PDPA”) that constrain the processing of personal data by organisations. The relevant data protection obligations include the Consent Obligation, Purpose Limitation Obligation, Retention Limitation Obligation and Transfer Limitation Obligation.