We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Applicability TestSingaporePDPA

Singapore PDPA Applicability Test

This test helps decide whether a Singapore PDPA issue is about handled by an organisation, a limited role, an excluded public agency or individual context, or .

Produce an activity-level scope record: identify the data, purpose, controlling organisation, intermediary processing, statutory boundary, applicable obligation set, evidence owner, and unresolved assumption.

Back to main artifactReview sources
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
4 sections6 primary sources
Overview

The Singapore PDPA applicability test starts with four questions: is the information , who controls or processes it, is any statutory boundary or exclusion relevant, and which PDPA obligation set is triggered by the activity.

Section 1

1. Confirm that the information is personal data

Treat the PDPA as potentially relevant when the information is data about an individual who can be identified from that data alone, or from that data together with other information the organisation has or is likely to have access to. The test does not depend on whether the data is true or accurate.

Record the data elements, the individual or individuals they relate to, and the other datasets or systems that could make the individual identifiable. If the team claims the dataset is anonymised or outside scope, keep the anonymisation method, residual re-identification assessment, and approval evidence.

  • In scope: customer, employee, user, patient, member, lead, or contact data that identifies a natural person directly or with other accessible information.
  • Still : inaccurate, outdated, inferred, derived, or mixed records if the individual is identifiable under the PDPA definition.
  • Format does not decide scope: the PDPA covers in electronic and non-electronic records, including databases, paper forms, recordings, and other media.
  • Boundary check: is generally outside Parts 3, 4, 5, 6, and 6A unless expressly mentioned, but only when it is not provided solely for personal purposes.
  • Evidence to keep: data inventory row, sample fields, identifiability analysis, business-contact-purpose note, and any anonymisation or de-identification record.
Section 2

2. Decide whether the actor is an organisation, data intermediary, or excluded actor

For each activity, first identify every legal person or other body handling the data. The PDPA definition of organisation is broad and can include an individual, company, association, or body of persons, whether or not formed or recognised under Singapore law or resident or established in Singapore. Then determine whether the actor handles the data for its own purposes or only on behalf of another organisation.

A vendor or service provider is a when it processes on behalf of another organisation and is not that organisation's employee. The narrower direct obligation set under section 4(2) applies only to processing on behalf of and for the other organisation's purposes under a contract evidenced or made in writing. The role can change by activity: the same company may be a data intermediary for customer-hosted data and an organisation for its own HR, billing, security, or marketing data.

  • Organisation test: the actor handles for its own purposes or is the party for whose purposes a performs the processing.
  • test: identify processing on behalf of another organisation, excluding its employees. Before relying on section 4(2)'s narrower direct obligation set, verify that the processing serves that organisation's purposes under a contract evidenced or made in writing.
  • Role-change trigger: if a uses the for its own purposes, assess that activity as an organisation activity.
  • Overseas actor check: an organisation does not fall outside the definition merely because it is not resident or established in Singapore; identify the activities involving in Singapore.
  • Evidence to keep: role matrix, customer or vendor contract, processing instructions, system owner, purpose owner, Singapore processing touchpoint, and records showing any independent use.
Section 3

3. Apply the PDPA boundary and exclusion checks

Do not stop at the label on the project. Check the statutory boundary for the actor, data, and activity. Parts 3, 4, 5, 6, 6A, and 6B do not impose obligations on individuals acting in a personal or domestic capacity, employees acting in the course of employment with an organisation, or public agencies.

Also check data-specific boundaries. The Act excludes in records that have existed for at least 100 years. For deceased individuals, the PDPA does not generally apply, except that disclosure provisions and the protection obligation can still apply to personal data about an individual who has been dead for 10 years or less.

  • Individual boundary: document whether the person is acting personally or domestically, or instead as an organisation or business actor.
  • Employee boundary: separate the employee's own employment conduct from the organisation's obligations for employee data and authorised staff actions.
  • Public agency boundary: confirm whether the actor is the Government, a ministry, department, agency, organ of State, tribunal, or specified statutory body.
  • Data boundary: check , records at least 100 years old, and about deceased individuals before assigning a full PDPA control set.
  • Evidence to keep: exclusion rationale, actor classification, statutory body check, employment-context note, data age or deceased-person note, and reviewer approval.
Section 4

4. Assign the obligation set and evidence record

When the activity is in scope, assign the obligation set that matches the role. Organisations should assess consent, notification, purpose limitation, access and correction, accuracy, protection, retention, transfer, breach notification, accountability, and any DNC marketing issue that applies to the activity.

For data-intermediary processing that meets section 4(2)'s purpose and written-contract conditions, focus the direct obligation record on protection, retention and breach escalation back to the organisation, alongside contractual instructions. If those conditions are not met, reassess the applicable obligations rather than assuming the narrower set applies. Other written law prevails where it conflicts with the PDPA, but a contract does not excuse a PDPA contravention.

  • For organisation activities: keep the purpose statement, notice text, consent or exception basis, access/correction owner, retention rule, transfer basis, DPO contact, and complaint route.
  • For activities: keep the written contract, processing instructions, security controls, deletion or return process, and breach escalation path.
  • For DNC marketing: separately record whether a Singapore telephone number is used for a specified marketing message and whether DNC checking or clear consent evidence is needed.
  • For breach response: record whether the incident involves , who is the organisation, whether a is involved, and who must assess or notify.
  • For governance: link the scope decision to the organisation's data protection policies, practices, training, and complaint process.
  • Reassess scope when the purpose, actor, contract, accessible datasets, hosting or processing location, individual group, or data format changes; a prior project label does not settle a changed activity.
Recommended next step

Turn the Singapore PDPA scope test into evidence

This Singapore PDPA applicability test helps capture personal data scope, organisation or data intermediary role, exclusions, owners, and review evidence for your team.

Assessment workflow
Open Assessment Autopilot for Singapore PDPA

Convert scope questions into assigned evidence fields, role checks, and review tasks.

Explore next step
Research workflow
Review Singapore PDPA source evidence

Use Research Copilot to check PDPA scope, role boundaries, exclusions, and cited sources.

Explore next step
Talk to Sorena
Talk through implementation

Review the applicability record, ownership model, exclusions, and next compliance actions with Sorena.

Explore next step
Primary sources

References and citations

Personal Data Protection Act 2012
sso.agc.gov.sg4 citations
Referenced sections
  • Primary statutory source for the PDPA purpose, definitions, application provisions, actor boundaries, and data-specific exclusions used in the applicability test.
  • Provides the statutory definitions of personal data, organisation, data intermediary, business contact information, and the application provisions used in this scope test.
  • Supports the statutory role definitions and the rule that an organisation remains responsible for personal data processed on its behalf.
Show 1 more
  • Provides the statutory application provisions for individuals acting personally or domestically, employees, public agencies, data intermediaries, business contact information, old records, and deceased individuals.
"The purpose of this Act is to govern the collection, use and disclosure of personal data by organisations"
More quoted passages
"“personal data” means data, whether true or not, about an individual who can be identified —"
"An organisation has the same obligation under this Act in respect of personal data processed on its behalf"
"Parts 3, 4, 5, 6, 6A and 6B do not impose any obligation on"
PDPC PDPA Overview
pdpc.gov.sg3 citations
Referenced sections
  • PDPC overview source for the public explanation of personal data, PDPA scope, excluded actors, business contact information, data protection obligations, and DNC Registry context.
  • Supports the baseline definition of personal data, the PDPA's role as Singapore's baseline protection law, and the stated exclusions for business contact information and other boundary cases.
  • Summarises the main PDPA scope boundaries for electronic and non-electronic data, personal or domestic activity, employees, public agencies, and business contact information.
"It comprises various requirements governing the collection, use, disclosure and care of personal data in Singapore."
More quoted passages
"Personal data refers to data about an individual who can be identified from that data"
"The PDPA covers personal data stored in electronic and non-electronic formats."
PDPC: The Distinction between Organisations and Data Intermediaries and Why It Matters
pdpc.gov.sg3 citations
Referenced sections
  • PDPC role guidance for deciding whether a party is acting as an organisation or data intermediary for a specific processing activity.
  • Explains the operational difference between organisations that control personal data processing and data intermediaries that process on behalf of another organisation.
  • Supports the role-based obligation split between organisations and data intermediaries, including protection, retention, and breach escalation for data intermediaries.
"An important first step is determining if your company acts as an organisation or data intermediary."
More quoted passages
"a data intermediary is defined as the entity that processes personal data “on behalf of another organisation.”"
"Organisations are subject to all eleven obligations specified under the PDPA"
PDPC Basic Anonymisation
pdpc.gov.sg2 citations
Referenced sections
  • PDPC anonymisation source for documenting claims that a dataset has been anonymised before analytics, sharing, or reduced-scope handling.
  • Supports the evidence step for teams claiming a dataset has been anonymised before use, sharing, or analytics.
"Anonymised personal data can be used to generate insights for innovation while providing protection to individuals."
More quoted passages
"anonymising data is one way to reduce that risk"
PDPC Guide on Managing and Notifying Data Breaches Under the PDPA
pdpc.gov.sg2 citations
Referenced sections
  • PDPC breach guide supporting the applicability check for personal data breach roles, assessment, notification criteria, and evidence.
  • Supports using the applicability record to identify personal data breach roles, assessment responsibility, notification criteria, and affected-individual evidence.
"mandatory Data Breach Notification Obligation under the PDPA"
More quoted passages
"help organisations to identify, prepare for, and manage data breaches"
PDPC Guide to Developing a Data Protection Management Programme
pdpc.gov.sg2 citations
Referenced sections
  • PDPC governance guide supporting the recommendation to keep applicability decisions in policies, practices, accountability records, and a DPMP.
  • Supports keeping PDPA applicability decisions inside policies, practices, governance, and a Data Protection Management Programme.
"This guide seeks to help organisations develop or improve their personal data protection policies and practices"
More quoted passages
"Organisations that collect, use and disclose personal data are required to develop and implement policies and practices"

Related guides

Singapore PDPA Anonymisation and DPIA Records

Build Singapore PDPA anonymisation and DPIA records around PDPC guidance: release model, re-identification risk, data flows, action plans, safeguards, and monitoring.

Singapore PDPA Breach Notification Playbook

A source-cited Singapore PDPA breach-notification playbook covering assessment, notifiable-breach thresholds, PDPC and affected-individual notification steps, roles, records, and citations.

Singapore PDPA Breach Notification Workflow

A source-cited Singapore PDPA workflow for containing a personal data breach, assessing notifiability, notifying PDPC or affected individuals, and retaining evidence.

Singapore PDPA Compliance Checklist

A source-cited Singapore PDPA checklist for scope, DPO accountability, consent, data intermediaries, breach notification, DNC checks, transfers, and evidence records.

Singapore PDPA Compliance Guide

Build a Singapore PDPA compliance plan covering DPO accountability, consent and notification, protection, retention, access and correction, transfers, breach notification, and DNC checks.

Singapore PDPA Consent and Deemed Consent Workflow

Choose express consent, deemed consent by conduct, contractual necessity, notification, or the legitimate interests exception under Singapore PDPA with fact-based intake fields and evidence records.

Show all related guides (37)

Singapore PDPA Consent, Notification and Purpose Rules

How Singapore PDPA consent, notification, purpose limitation, deemed consent, withdrawal, and consent exceptions should be handled in product and privacy workflows.

Singapore PDPA Cross-Border Transfers

Source-cited Singapore PDPA guidance for overseas personal data transfers, comparable protection, ASEAN MCCs, APEC certifications, vendor roles, and evidence records.

Singapore PDPA Data Breach Notification Thresholds

Source-cited Singapore PDPA breach notification thresholds covering significant harm, the 500-individual significant-scale test, assessment records, and notification timing.

Singapore PDPA Data Intermediary Responsibilities

Practical Singapore PDPA guide to data intermediary role boundaries, organisation accountability, protection, retention, breach escalation, and contract evidence.

Singapore PDPA Deadlines and Compliance Calendar

A Singapore PDPA compliance calendar for breach notification, DNC checks, access and correction requests, enforcement responses, retention reviews, and DPMP maintenance.

Singapore PDPA Deemed Consent and Legitimate Interests

How to apply Singapore PDPA deemed consent by conduct, contractual necessity, notification, and legitimate interests with opt-out, adverse-effect, disclosure, and assessment records.

Singapore PDPA DNC and Marketing Messages Guide

A source-cited Singapore PDPA guide to DNC checks, specified marketing messages, Singapore telephone numbers, consent evidence, opt-outs, sender duties, and excluded messages.

Singapore PDPA DNC Marketing Checks

Operational checklist for Singapore PDPA DNC marketing checks: account evidence, register status, 21-day result validity, consent evidence, and campaign owner records.

Singapore PDPA DNC Marketing Workflow

Workflow for Singapore PDPA DNC marketing campaigns: classify specified messages, check Singapore telephone numbers, document consent, suppress opt-outs, and approve sends.

Singapore PDPA DPMP Accountability Guide

Build a Singapore PDPA Data Protection Management Programme with DPO ownership, policies, data inventories, DPIAs, training, monitoring, breach logs, and review records.

Singapore PDPA FAQ: scope, DPO, consent, breaches and DNC

FAQ answers for Singapore PDPA implementation, covering scope, accountability, consent, access and correction, security, retention, transfers, data intermediaries, breach notification, and DNC checks.

Singapore PDPA NRIC Handling Rules

When Singapore organisations may collect, use, disclose, retain, mask, or replace NRIC numbers, including the 31 December 2026 authentication deadline.

Singapore PDPA Penalties and Enforcement Cases

How PDPC enforcement under Singapore's PDPA works: directions, voluntary undertakings, published decisions, financial penalty caps, and implementation lessons from cases.

Singapore PDPA Penalties and Fines

Singapore PDPA penalty ceilings, PDPC directions, undertakings, breach notification context, and practical controls based on official PDPC and Singapore Statutes sources.

Singapore PDPA Privacy Policy Template

A Singapore PDPA privacy policy template for writing notices, DPO contact details, access and correction routes, retention, transfers, protection, withdrawal, and complaint handling without overclaiming compliance.

Singapore PDPA Requirements: Core Obligations

Map Singapore PDPA obligations across consent, notification, access, security, retention, transfers, accountability, breaches, DNC checks, and data intermediaries.

Singapore PDPA Scope, Exclusions, and Data Intermediaries

Classify Singapore PDPA coverage, business contact information, personal or domestic activity, employee acts, and data intermediary obligations using cited statutory boundaries and processing records.

Singapore PDPA Transfer Assessment Workflow

A Singapore PDPA workflow for assessing overseas personal data transfers, comparable protection, ASEAN MCCs, APEC CBPR/PRP certifications, vendor due diligence, onward transfers, and evidence records.

Singapore PDPA Transfer Clauses

Draft Singapore PDPA transfer clauses for overseas vendors, affiliates, data intermediaries, onward transfers, ASEAN MCCs, and APEC or Global CBPR and PRP evidence.

Singapore PDPA Vendor Outsourcing and Contracts

Contract and operating checklist for Singapore PDPA vendor outsourcing: data intermediary status, written terms, security, retention, breach, transfers, sub-contracting, and exit evidence.

Singapore PDPA vs GDPR Comparison

Compare Singapore PDPA and EU GDPR rules for legal bases, DPOs, intermediaries and processors, transfers, breaches, marketing objections, rights, retention, and penalties.

Singapore PDPA anonymisation FAQ

FAQ on anonymisation under the Singapore PDPA: de-identification, pseudonymisation, re-identification risk, when PDPA may no longer apply, and evidence records.

Singapore PDPA breach notification thresholds FAQ

FAQ on Singapore PDPA notifiable data breach tests: significant harm, significant scale, 500 affected individuals, assessment timing, PDPC notices, and affected-individual notices.

Singapore PDPA Data Intermediaries FAQ

FAQ guidance on Singapore PDPA data intermediary roles, direct obligations, organisation accountability, contracts, retention, protection, and breach escalation.

Singapore PDPA Deemed Consent FAQ

FAQ on Singapore PDPA deemed consent by conduct, contractual necessity, notification, opt-out periods, adverse-effect assessment, withdrawal, and direct-marketing limits.

Singapore PDPA DNC checking FAQ: when to check the DNC Registry

FAQ guidance on Singapore PDPA DNC checking: when to check the DNC Registry, which registers apply, 8-digit numbers, 21-day result validity, consent evidence, on-behalf checks, opt-outs, and supported exclusions.

Singapore PDPA DPIAs: when to run and what to document

FAQ-style implementation guidance on Singapore PDPA DPIAs, including when PDPC guidance recommends them, data-flow mapping, risk treatment, DPO review, and evidence records.

Singapore PDPA DPMP Accountability FAQ | DPO, Policies, Evidence

FAQ for implementing Singapore PDPA accountability through a DPMP: DPO designation, policies, evidence, training, monitoring, incident logs, and review records.

Singapore PDPA legitimate interests FAQ

FAQ guidance on Singapore PDPA legitimate interests: assessment fields, adverse effects, mitigation, balancing, disclosure, records, and marketing limits.

Singapore PDPA NRIC Handling FAQ

FAQ guidance on when Singapore organisations may collect, use, disclose, retain, mask, or replace NRIC and other national identification numbers under PDPC guidance.

Singapore PDPA transfer clauses FAQ

FAQ guidance on Singapore PDPA transfer clauses, comparable protection, ASEAN MCCs, APEC CBPR and PRP certifications, onward transfers, and evidence records.