Singapore PDPA deadlines and compliance calendar

Open a breach calendar entry when the organisation has credible grounds to believe that a data breach has occurred, including where a data intermediary reports the breach. The assessment owner should determine whether it is a notifiable breach and document containment, facts established, data affected, likely harm, number of affected individuals, and the decision.

The Act requires reasonable and expeditious assessment. PDPC guidance uses 30 calendar days as the operational benchmark: if the organisation cannot finish within that period, it should be ready to explain the time taken or required. Treat 30 days as an escalation point, not permission to delay an assessment that could reasonably be completed earlier.

Open a DNC calendar entry before a telemarketing campaign sends specified messages to Singapore telephone numbers, unless the campaign has clear and unambiguous consent in evidential form or another cited exception applies.

DNC Registry results are not evergreen. Campaign operations should treat the result date as a hard expiry control and re-check before continuing telemarketing after the validity period lapses.

Open an access or correction request entry when a written request reaches the DPO business contact information, registered office, principal office, or another accepted channel with enough detail to identify the applicant and request.

The PDPA timing language is not a permission to wait until day 30. Access must be provided as soon as reasonably possible, and correction must be made as soon as practicable, subject to exceptions and valid grounds.

Open an enforcement calendar entry as soon as the PDPC issues a written notice, preliminary decision, final decision, direction, or financial penalty. These clocks concern the regulatory process after PDPC action; they do not replace any remediation deadline stated in the notice or direction.

The enforcement guidelines give an organisation or person 14 days to make written representations on a preliminary decision and proposed action. An extension may be requested, but the Commission may grant it only if exceptional circumstances in the particular case warrant more time.

A person aggrieved by an eligible decision, direction, or financial penalty may apply for reconsideration within 28 days, or appeal an eligible decision or direction within 28 days. The available route and standing depend on the specific provision. A reconsideration application or appeal generally does not suspend the contested decision, except for a financial penalty, unless the Commission or appeal committee decides otherwise.

The PDPA does not set one universal retention period for all personal data. Calendar entries should therefore track each record class against its collection purpose, legal or business need, retention rationale, and disposal or anonymisation method.

For privacy programme maintenance, PDPC guidance supports both ad-hoc updates when major incidents, legal changes, or organisational changes occur and periodic review at a pre-specified interval chosen by the organisation.