Singapore PDPA Compliance checklist

Supports the scope checklist because the guidance explains the PDPA's purpose, data protection provisions, DNC provisions, and reasonableness requirement.

The PDPA governs the collection, use and disclosure of individuals’ personal data by organisations

Supports DPO and accountability checks because it explains designation of DPOs, accessible business contact information, policies, complaints, training, and policy availability.

Section 11(3) of the PDPA requires an organisation to designate one or more individuals

Supports operational checklist records because the DPMP guide recommends governance, data inventories, risk reviews, staff training, monitoring, incident logs, and remediation tracking.

An effective data protection policy is one that can be operationalised into business processes.

Supports consent and notification checks because the key concepts guidance covers consent, deemed consent, notification, withdrawal, access, correction, and exceptions.

Having reasonable purposes, notifying purposes and obtaining consent

Supports evidence for legitimate interests decisions because PDPC provides an assessment structure for documenting the purpose, benefit, adverse effect, and safeguards.

organisations may wish to conduct their own

Supports vendor checklist controls because the guide covers data controller and data intermediary roles, contracts, risk assessment, service management, and exit management.

key considerations for organisations when outsourcing data processing activities

Supports data intermediary scope because it explains that data intermediaries are subject to protection, retention, and breach notification obligations for contracted processing.

will only be subject to the Data Protection Provisions relating to

Supports protection, accuracy, retention, and transfer checklist items because the key concepts guidance groups these duties under care of personal data.

Taking care of personal data

Supports retention controls because the guide cites section 25's requirement to stop retaining documents or remove identifiability when the purpose and legal or business need no longer support retention.

cease to retain its documents containing personal data

Supports breach assessment and notification controls because the guide covers assessment, significant harm, significant scale, PDPC notification timing, affected-individual notification, and notification content.

the organisation must notify

Supports the PDPC notification timing check because PDPC states that a notifiable breach should be reported as soon as practicable and no later than three calendar days.

no later than three (3) calendar days

Supports DNC checklist items because the guidance covers specified messages, duty to check the DNC Register, clear and unambiguous consent, the 21-day validity period, third-party checkers, and dictionary-attack and address-harvesting prohibitions.

before a person sends a specified message

Supports operational DNC evidence because the DNC Registry business-rules page explains main accounts and sub-accounts for organisations or individuals checking the DNC Registry.

perform telephone number checks against the DNC Registry

Supports transfer checks because the guidance explains comparable protection, due diligence, legally enforceable obligations, certifications, and transfer scenarios.

protected to a standard comparable with the Data Protection Provisions

Supports cross-border contract checks because PDPC recognises ASEAN MCCs for the transfer limitation obligation and recommends PDPA-specific clarifications for breach timing and affected-individual responsibility.

recognises and encourages the use of the ASEAN MCCs

Supports evidence-record checks because the DPMP guide recommends inventories, monitoring, incident logs, remediation plans, audits, regular reviews, and communication of policy changes.

document data incidents and data breaches in an incident record log

Supports breach evidence records because PDPC guidance says organisations must document all steps taken when assessing whether a breach is notifiable.

must document all steps taken in assessing the data breach