Singapore PDPA
Singapore PDPA overview covering scope, accountability, consent and notification, public contact information, data intermediaries, breach notification, DNC checks, transfers, and evidence records.
For each processing activity, identify the , statutory boundary, organisation or data-intermediary role, purpose and consent route, then assign the lifecycle, breach, marketing, and transfer controls that follow.
The PDPA applies to activities involving in Singapore, including relevant activities by overseas organisations. The same business can be the accountable organisation for its own processing and a when it processes personal data on behalf of and for another organisation's purposes under a written or evidenced contract.
Keep the record, evidence that the relevant business contact information is available to the public, data protection policies, complaint process, staff communications, and evidence that policies are implemented.
A processes on behalf of another organisation under a written or evidenced contract. Its direct PDPA duties for that processing cover protection, retention limitation, and breach notice to the engaging organisation or public agency without undue delay; the engaging organisation remains responsible for the wider obligation set.
Take reasonable and expeditious steps to assess suspected breaches. guidance says to complete the assessment within 30 calendar days; the statutory PDPC notification clock is no later than 3 calendar days after determining that the breach is notifiable.
Confirm whether the activity involves about an identifiable individual and a Singapore processing activity, whether an actor or data boundary applies, and whether each party acts as an organisation or for that specific processing. The PDPA covers electronic and non-electronic records; inaccurate or inferred data can still be personal data.
Document designation, business contact information made available to the public, collection-use-disclosure purposes, consent or deemed-consent basis, notification text, complaints process, staff training, and policy access. The main data protection rules took effect on 2 July 2014, and the 2020 amendments took effect in phases from 1 February 2021. Treat data portability as under development, not an active transfer-on-request duty, unless a later commencement source applies.
Prepare breach assessment records, vendor breach escalation, checking evidence, marketing-consent proof, and overseas-transfer safeguards such as comparable-protection clauses or recognised certifications.
Use the hub to connect PDPA scope, accountability, breach notification, , , and transfer checks to evidence records.
Start with the guide that matches the processing, marketing, incident, enforcement, or transfer decision under Singapore's Protection Act (PDPA). The complete guide library follows below.
Deemed consent allows specified processing without express consent when the PDPA's conditions are met. Separate consent inferred from conduct, processing needed for a contract, deemed consent by notification, and the legitimate-interests exception. For notification or legitimate interests, document the assessment, reasonable steps, notice, opt-out where required, safeguards, and approval.
The Do Not Call (DNC) Registry lets people register Singapore telephone numbers against marketing calls, texts, or faxes. Decide whether the message advertises or promotes goods, services, interests, suppliers, or business opportunities and therefore counts as a specified message. Then record the DNC check, clear consent, or applicable exclusion.
A breach is notifiable when it is likely to cause or affects at least 500 people, which is . The Protection Commission () recommends completing the initial assessment within 30 calendar days. Once the organization determines that notification is required, the statutory three-calendar-day notification clock starts.
An overseas transfer sends or makes accessible outside Singapore. Before the transfer, choose a permitted route and ensure the recipient provides protection comparable to the PDPA, commonly through enforceable contractual duties. Record the destination, purpose, data, recipient checks, safeguards, onward-transfer limits, and ongoing oversight.
The can issue directions, accept enforceable undertakings, and impose financial penalties after considering the facts of the contravention. Estimate exposure from the legal maximum, the organization's turnover where relevant, the harm, duration, intent, mitigation, cooperation, and prior conduct. One headline amount does not predict the penalty in another case.
New to the PDPA? Start with the activity-level applicability and role tests. If those decisions are already documented, jump to the consent route, vendor or transfer control, incident clock, marketing check, or evidence tool you need.
Establish what and activity are in scope, test the exclusions, classify each party as an organisation or for that activity, and map the obligations that follow.
Choose and document the collection, use, or disclosure basis; build the accountability programme; and apply the specific controls for notices, NRIC data, anonymisation, and impact assessment.
Allocate organisation and intermediary duties per processing activity, contract for instructions and breach escalation, and prove comparable protection before leaves Singapore.
Separate the significant-harm and significant-scale tests, open the assessment record promptly, apply the post-determination notification clock, and understand how directions and financial penalties work.
Classify specified messages to Singapore telephone numbers, preserve DNC or consent evidence, use the implementation checklist, compare the PDPA with the GDPR, or go directly to a focused answer.
"An organisation is responsible for personal data in its possession or under its control."
"template contractual terms and conditions"
"voice calls, text or fax messages"
"baseline standard of protection for personal data in Singapore"
"no later than three (3) calendar days"
"Note that this requirement is currently under development."
"the prescribed number of affected individuals is 500"
"An organisation has the same obligation under this Act in respect of personal data processed on its behalf"
Next steps
Identify the processing activity, assign an owner, connect each PDPA obligation to an official source, and keep evidence that the control operates.
Turn PDPA obligations into owners, evidence requests, review checkpoints, and remediation follow-up.
Answer Singapore PDPA scope, breach, DNC, transfer, and interpretation questions with cited outputs.
Align PDPA scope, breach, DNC, intermediary, and transfer checkpoints across stakeholders.
Review your current process, evidence model, and next implementation steps.