Start with the processing activity, not a company-wide label: identify the , statutory boundary, organisation or data-intermediary role, purpose and consent route, then assign the lifecycle, breach, marketing, and transfer controls that follow.
This hub helps align legal, security, marketing, vendor management, and operations on the same Singapore PDPA evidence set.
The PDPA applies to activities involving in Singapore, including relevant activities by overseas organisations. The same business can be the accountable organisation for its own processing and a when it processes personal data on behalf of and for another organisation's purposes under a written or evidenced contract.
Focused Singapore PDPA guidance
Start with the guide that matches the processing, marketing, incident, enforcement, or transfer decision under Singapore's Protection Act (PDPA). The complete guide library follows below.
Deemed consent allows specified processing without express consent when the PDPA's conditions are met. Separate consent inferred from conduct, processing needed for a contract, deemed consent by notification, and the legitimate-interests exception. For notification or legitimate interests, document the assessment, reasonable steps, notice, opt-out where required, safeguards, and approval.
Compare the consent routesThe Do Not Call (DNC) Registry lets people register Singapore telephone numbers against marketing calls, texts, or faxes. Decide whether the message advertises or promotes goods, services, interests, suppliers, or business opportunities and therefore counts as a specified message. Then record the DNC check, clear consent, or applicable exclusion.
Review the DNC rulesA breach is notifiable when it is likely to cause or affects at least 500 people, which is . The Protection Commission () recommends completing the initial assessment within 30 calendar days. Once the organization determines that notification is required, the statutory three-calendar-day notification clock starts.
Open the breach playbookAn overseas transfer sends or makes accessible outside Singapore. Before the transfer, choose a permitted route and ensure the recipient provides protection comparable to the PDPA, commonly through enforceable contractual duties. Record the destination, purpose, data, recipient checks, safeguards, onward-transfer limits, and ongoing oversight.
Review transfer safeguardsThe can issue directions, accept enforceable undertakings, and impose financial penalties after considering the facts of the contravention. Estimate exposure from the legal maximum, the organization's turnover where relevant, the harm, duration, intent, mitigation, cooperation, and prior conduct. One headline amount does not predict the penalty in another case.
Review penalties and enforcementUse the hub to connect PDPA scope, accountability, breach notification, , , and transfer checks to evidence records.
New to the PDPA? Start with the activity-level applicability and role tests. If those decisions are already documented, jump to the consent route, vendor or transfer control, incident clock, marketing check, or evidence tool you need.
Establish what personal data and activity are in scope, test the exclusions, classify each party as an organisation or data intermediary for that activity, and map the obligations that follow.
Choose and document the collection, use, or disclosure basis; build the accountability programme; and apply the specific controls for notices, NRIC data, anonymisation, and impact assessment.
Allocate organisation and intermediary duties per processing activity, contract for instructions and breach escalation, and prove comparable protection before personal data leaves Singapore.
Separate the significant-harm and significant-scale tests, open the assessment record promptly, apply the post-determination notification clock, and understand how PDPC directions and financial penalties work.
Classify specified messages to Singapore telephone numbers, preserve DNC or consent evidence, use the implementation checklist, compare the PDPA with the GDPR, or go directly to a focused answer.
This hub is the intake point for PDPA implementation work: identify the processing activity, assign the right owner, connect the obligation to an official source, and keep the record that proves the control is operating.
