Use this calendar to schedule breach assessment, PDPC notification, affected-individual notification, DNC Registry checks, access and correction requests, enforcement responses, and privacy programme reviews.
Each clock starts from a specific event. Record that event, the applicable rule or guidance, the owner, the due date, and evidence of the response.
Structured answer sets in this page tree.
Cited legal and guidance references.
Use this calendar for event-driven PDPA clocks, not as a claim that every item has the same legal force. The three-day breach-notification deadline, DNC checking window, and 28-day reconsideration and appeal periods come from binding instruments; the 30-day breach-assessment point and 14-day preliminary-decision representation period are PDPC guidance; retention and programme reviews use organisation-set dates tied to purpose, risk, and change events. Record the trigger, source, legal status, owner, due date, outcome, and proof for each entry.
Open a breach calendar entry when the organisation has credible grounds to believe that a data breach has occurred, including where a data intermediary reports the breach. The assessment owner should determine whether it is a and document containment, facts established, data affected, likely harm, number of affected individuals, and the decision.
The Act requires reasonable and expeditious assessment. PDPC guidance uses as the operational benchmark: if the organisation cannot finish within that period, it should be ready to explain the time taken or required. Treat 30 days as an escalation point, not permission to delay an assessment that could reasonably be completed earlier.
Open a DNC calendar entry before a telemarketing campaign sends specified messages to Singapore telephone numbers, unless the campaign has clear and unambiguous consent in evidential form or another cited exception applies.
results are not evergreen. Campaign operations should treat the result date as a hard expiry control and re-check before continuing telemarketing after the validity period lapses.
Open an access or correction request entry when a written request reaches the DPO business contact information, registered office, principal office, or another accepted channel with enough detail to identify the applicant and request.
The PDPA timing language is not a permission to wait until day 30. Access must be provided as soon as reasonably possible, and correction must be made as soon as practicable, subject to exceptions and valid grounds.
Open an enforcement calendar entry as soon as the PDPC issues a written notice, preliminary decision, final decision, direction, or financial penalty. These clocks concern the regulatory process after PDPC action; they do not replace any remediation deadline stated in the notice or direction.
The enforcement guidelines give an organisation or person 14 days to make written representations on a preliminary decision and proposed action. An extension may be requested, but the Commission may grant it only if exceptional circumstances in the particular case warrant more time.
A person aggrieved by an eligible decision, direction, or financial penalty may apply for reconsideration within 28 days, or appeal an eligible decision or direction within 28 days. The available route and standing depend on the specific provision. A reconsideration application or appeal generally does not suspend the contested decision, except for a financial penalty, unless the Commission or appeal committee decides otherwise.
The PDPA does not set one universal retention period for all personal data. Calendar entries should therefore track each record class against its collection purpose, legal or business need, retention rationale, and disposal or anonymisation method.
For privacy programme maintenance, PDPC guidance supports both ad-hoc updates when major incidents, legal changes, or organisational changes occur and periodic review at a pre-specified interval chosen by the organisation.
This Singapore PDPA calendar helps create breach, DNC, access, correction, enforcement, retention, and DPMP review controls with owners, due dates, and evidence fields.
Turn PDPA timing windows into scoped questions, evidence fields, and review tasks.
Use Research Copilot to check follow-up questions against cited PDPC and statutory sources.
Review calendar ownership, escalation paths, and evidence records for Singapore PDPA operations.
"does not specify a fixed duration"
"Duty to check the DNC Register"
"within 30 calendar days"
"valid for up to 21 days"
"Revision of data protection policies and processes at regular intervals"
"no later than three (3) calendar days"