Singapore PDPA Privacy Policy Template

Start with the activities that actually collect, use, or disclose personal data: account creation, service delivery, payments, support, security, analytics, recruitment, events, marketing, and vendor processing. For each activity, write the purpose in language an individual can understand and distinguish required purposes from optional ones.

Avoid catch-all wording such as using data for valid business purposes. PDPC guidance says organisations may notify individuals through a Data Protection Policy, but broad website wording may still need a more specific notice at the point where the individual provides data.

Include a PDPA contact section that individuals can actually use. The policy should name the business contact channel for data protection questions, access and correction requests, withdrawal notices, and complaints. If the DPO and the public contact person are different, the policy should make that routing clear.

Back the public policy with internal ownership. Assign an owner for updates, teach staff where to route requests, and maintain a process to receive and respond to PDPA complaints.

The template should explain how an individual can ask for access to personal data, request correction, withdraw consent, and raise a complaint. It should also explain that identity verification or request clarification may be needed, that a reasonable access fee may apply if the organisation gives a written estimate, and that access may be limited where a PDPA exception or prohibition applies.

Retention, protection, and transfer clauses should be specific enough to describe the organisation's approach without inventing fixed legal periods. The PDPA does not prescribe a universal retention period; the policy should connect retention to the original purpose and legal or business needs, then point to disposal, deletion, return, or anonymisation when retention is no longer justified.

The following drafting examples are not official PDPC wording. Replace every bracketed field, remove clauses that do not describe your practices, and add specific collection notices where the public policy is too general.

Scope and purposes: [Organisation] collects [data categories] through [collection points] to [specific purposes]. We disclose [data categories] to [recipient categories] for [specific purposes]. [Explain which fields are required to provide the service and which uses are optional.]

Requests and contact: To request access to or correction of your personal data, withdraw consent for a stated purpose, or raise a data protection complaint, contact [DPO or data protection contact] at [email or mailing address]. We may ask for information needed to verify your identity and locate the records. We will explain any likely consequences of withdrawing consent. Requests remain subject to applicable PDPA limits and exceptions.

Retention and protection: We retain personal data while it serves the purposes for which it was collected or remains necessary for legal or business purposes. We [describe the actual review and disposal process]. We use [accurate high-level safeguards] to protect personal data; do not include safeguards that have not been implemented.

Overseas transfers, if applicable: We transfer [data categories] to [recipient categories and locations] for [purposes]. We use [the actual prescribed transfer route and safeguards] to meet the PDPA requirements for those transfers. [Describe how individuals can ask questions about the transfer.]

Marketing, if applicable: We use [data categories] for [specific marketing purposes] on the basis of [the applicable consent or other basis]. You can withdraw consent for [channels or purposes] through [working withdrawal route]. For specified messages to Singapore telephone numbers, we separately apply the Do Not Call requirements.

A privacy policy should not be used to paper over unknown processing. If the data map, vendors, transfer destinations, marketing flows, retention rules, or complaint routes are unclear, mark them for remediation before publishing absolute claims.

Marketing needs particular care. Consent language in a privacy policy is not the same as proving that every future marketing message is lawful. For specified messages to Singapore telephone numbers, teams should check whether the Do Not Call provisions apply and keep evidence of clear and unambiguous consent where relying on it.