TRW & Co · Technology, IP & Data
Data Protection and PDPA Compliance in Singapore
PDPA compliance in Singapore is about showing, with documents, that your organisation handles personal data lawfully: on a proper legal basis, securely, for stated purposes and through vendors you control. With penalties of up to 10% of Singapore turnover and mandatory breach reporting, it is now a board-level risk. This guide sets out the framework, decisions and practical steps for 2026.
Key pointSince 2021, the strongest PDPA tools, deemed consent by notification, legitimate interests and business improvement, depend on written assessments made before processing starts. Organisations that cannot produce those documents lose the flexibility the law gives them.
At a glance
Penalty cap raised
Since 1 October 2022, financial penalties can reach 10% of annual Singapore turnover for organisations whose turnover exceeds S$10 million, or S$1 million otherwise.
Breach reporting is mandatory
Notifiable breaches must be reported to PDPC within three calendar days of the organisation determining that the breach is notifiable, after an assessment of up to 30 days.
Wider consent options
The 2021 amendments added deemed consent by notification, a legitimate interests exception and a business improvement exception, each with conditions and documentation duties.
A DPO is required
Every organisation must designate at least one person responsible for PDPA compliance and make that person’s business contact information publicly available.
Transfers need safeguards
Overseas recipients must be bound by enforceable obligations of comparable protection, such as contracts, binding corporate rules or APEC CBPR and PRP certifications.
Swipe or scroll →
What PDPA compliance in Singapore covers
PDPA compliance in Singapore means showing that your organisation collects, uses, discloses and looks after personal data in line with the Personal Data Protection Act 2012. The Act applies to almost every private-sector organisation that handles data about identifiable individuals in Singapore, whether or not the organisation is incorporated or physically present here.
"Personal data" is defined broadly. It covers any data, true or not, from which an individual can be identified, alone or combined with other information the organisation has or is likely to access. Customer records, employee files, CCTV footage, device identifiers linked to accounts and call recordings all qualify. Business contact information used for business purposes is largely carved out.
The question usually becomes a legal one at predictable moments: a product launch that relies on new data uses, a move to a cloud or offshore service provider, a marketing campaign, an investor's due diligence questionnaire, a request from an individual for their data, or an incident. Each of those moments tests whether your policies match what actually happens to the data.
Public agencies are governed by separate public-sector rules, not the PDPA. Private organisations acting as contractors to government, however, remain subject to the PDPA and usually also to contractual security requirements from the agency.
The legal and regulatory framework
The Personal Data Protection Act 2012 sets out two broad regimes: the data protection obligations, which govern how organisations handle personal data, and the Do Not Call (DNC) provisions, which govern marketing messages to Singapore telephone numbers. The Personal Data Protection Commission (PDPC), which sits within the Infocomm Media Development Authority (IMDA), administers and enforces both.
The Act was substantially amended by the Personal Data Protection (Amendment) Act 2020. Most changes took effect on 1 February 2021, including mandatory data breach notification, new consent exceptions and offences for individuals who mishandle personal data. Higher financial penalties followed on 1 October 2022.
The core obligations
Practitioners usually group the data protection provisions into a set of obligations. Each one is a separate compliance requirement, and PDPC decisions frequently find breaches of more than one at a time.
| Obligation | What it requires | Common evidence of compliance |
|---|---|---|
| Consent | Obtain consent, or rely on deemed consent or a statutory exception, before collecting, using or disclosing personal data | Consent wording, records, exception assessments |
| Purpose limitation | Use data only for purposes a reasonable person would consider appropriate and that have been notified | Purpose register mapped to data flows |
| Notification | Tell individuals the purposes on or before collection | Privacy notices at each collection point |
| Access and correction | Respond to requests for data and how it has been used, and correct errors | Request log, response templates, fee policy |
| Accuracy | Make reasonable effort to keep data accurate and complete where it is used for decisions or disclosed | Data quality checks |
| Protection | Make reasonable security arrangements against unauthorised access and similar risks | Security policies, access controls, vendor audits |
| Retention limitation | Stop retaining data once the purpose and any legal or business need ends | Retention schedule and disposal records |
| Transfer limitation | Ensure overseas recipients provide a comparable standard of protection | Transfer contracts, certifications, transfer register |
| Accountability | Appoint a data protection officer, adopt policies and make them available | DPO appointment, published policy, training records |
| Data breach notification | Assess suspected breaches and notify PDPC and individuals where required | Incident response plan and assessment records |
The Act also contains a data portability obligation, but at the time of writing it has not been brought into force. Organisations should watch for PDPC consultations on it rather than build for it now.
Advisory guidelines and related laws
PDPC's advisory guidelines are not law, but the Commission applies them when it investigates, so they function as the practical standard. Sector guidelines cover areas such as healthcare, education, real estate agency and telecommunications, and topic guidelines cover NRIC numbers, CCTV, employment and the use of personal data in AI recommendation and decision systems.
PDPA compliance in Singapore also overlaps with other regimes. Financial institutions answer to MAS requirements on technology and third-party risk management, and the Cyber Security Agency (CSA) publishes a useful overview of cybersecurity, personal data and computer misuse laws. The Spam Control Act 2007 applies separately to unsolicited commercial electronic messages.
Consent, deemed consent and the exceptions
Consent remains the default basis, but since 2021 the Act gives organisations more realistic options. Choosing the right basis for each purpose is the most consequential design decision in a privacy programme, because the basis determines what you must tell people and whether they can withdraw.
Express consent
Clear, specific consent obtained before collection. Best for marketing and sensitive uses. Bundled consent as a condition of service is only valid where the data is reasonably required to provide that service.
Deemed consent by conduct or contract
Arises where an individual voluntarily provides data for a purpose, or where disclosure to a third party is needed to perform a contract with the individual. Useful for fulfilment chains, but limited to what is reasonably necessary.
Deemed consent by notification
Allows new uses if you notify individuals, give a reasonable opt-out period and first assess that the use is not likely to have an adverse effect. The assessment must be documented, and the route cannot be used for direct marketing.
Legitimate interests
Permits collection, use or disclosure without consent where the organisation's legitimate interests outweigh any adverse effect on the individual, after a documented assessment. Fraud detection and information security are typical uses.
Business improvement
Allows use of personal data, without consent, to improve products, services or operations, or to understand customers, where the purpose cannot reasonably be achieved with anonymised data.
Research and other exceptions
The Act lists further exceptions, including research, investigations, publicly available data and emergencies. Each has conditions, so record which exception you are relying on and why it applies.
Two practical points follow. First, an assessment under deemed consent by notification or legitimate interests is a document PDPC can ask to see; if it was not written before the processing started, it is hard to defend. Second, consent can be withdrawn on reasonable notice, and your systems must be able to act on withdrawal across every place the data is used, including service providers.
Designing a proportionate compliance programme
A credible programme for PDPA compliance in Singapore does not need to be large, but it must be real. PDPC investigations ask whether policies exist, whether staff know them and whether the organisation can show they are applied. A fifty-page policy nobody follows counts for little.
The data protection officer
Every organisation must designate at least one individual to be responsible for ensuring compliance, commonly called the data protection officer (DPO), and make that person's business contact information publicly available. The role can be outsourced, but accountability cannot. ACRA's BizFile+ also invites companies to record their DPO's contact details. Our guide to data protection officers explains what a workable DPO mandate looks like.
Data protection management programme and impact assessments
PDPC encourages a data protection management programme that links governance, risk assessment, processes and monitoring. A data protection impact assessment (DPIA) is not mandatory in every case, but it is the most efficient way to evidence the assessments the Act does require, such as legitimate interests balancing. IMDA's Data Protection Trustmark offers voluntary certification for organisations that want an external benchmark.
Right-sizing for the organisation
A ten-person start-up and a regional bank face the same Act but very different expectations. Start-ups should focus on a data inventory, notices, a breach plan and vendor contracts. Larger groups need policy hierarchies, training, internal audit and board reporting. Our article on data compliance for start-ups sets out a lean first-year plan.
Implementation: a practical sequence
Most organisations come to PDPA compliance in Singapore with something already in place. The sequence below works whether you are building from scratch or repairing a programme after an audit finding.
- Map the data. Build an inventory of the personal data you hold, where it comes from, which systems and vendors touch it, where it is stored and who can access it. Without this, every later step is guesswork.
- Assign the legal basis. For each purpose, record whether you rely on consent, deemed consent or an exception, and complete any written assessment the basis requires.
- Fix notices and consents. Rewrite privacy notices so they match real uses, in plain language, at the point of collection. Separate marketing consent from service terms.
- Set security and retention controls. Agree access controls, encryption, logging and retention periods with IT and business owners, and plan disposal of legacy data.
- Contract with vendors. Put data processing terms in place with every data intermediary, covering protection, retention, breach notification and sub-processing, and add transfer clauses for overseas recipients.
- Prepare for requests and incidents. Create workflows for access and correction requests and a tested breach response plan aligned with PDPC's guide.
- Train and monitor. Train staff by role, schedule periodic reviews and report key metrics to management or the board.
Overseas transfers, vendors and data intermediaries
A data intermediary processes personal data on behalf of another organisation under a written contract. It carries only some obligations directly, mainly protection, retention limitation and notifying the controller of breaches, while the organisation that engaged it remains responsible for everything else. In practice, this makes the vendor contract the main compliance tool.
Transfers outside Singapore must meet the transfer limitation obligation. Under the Personal Data Protection Regulations 2021, the transferring organisation must take steps to ensure the recipient is bound by legally enforceable obligations giving a comparable standard of protection. Those obligations can come from contract, binding corporate rules within a group, or specified certifications such as the APEC Cross-Border Privacy Rules and Privacy Recognition for Processors systems.
The ASEAN Model Contractual Clauses are a convenient starting point for intra-ASEAN transfers. Our guides to cross-border data transfers and vendor contracts cover drafting in detail, and the cloud and outsourcing page covers the wider commercial terms.
A vendor that holds your customers' data is part of your compliance programme whether or not your contract says so.
Enforcement, penalties and the Do Not Call rules
PDPC investigates on complaint, on breach notification and on its own initiative. Outcomes range from advisory notices and directions to financial penalties. Since 1 October 2022, the maximum financial penalty is S$1 million or, for organisations with annual turnover in Singapore above S$10 million, 10% of that turnover, whichever is higher. PDPC can also accept voluntary undertakings, which allow an organisation to commit to remedial steps instead of a full investigation outcome.
PDPC publishes its decisions, and the recurring themes are instructive: weak passwords and access controls, misconfigured cloud storage, inadequate vendor oversight, and sending personal data to the wrong recipient. The mitigating factors it credits include prompt notification, effective containment and cooperation. Our note on PDPA enforcement tracks the trends.
The 2020 amendments also created offences for individuals who knowingly or recklessly make unauthorised disclosures of personal data, misuse it for gain or harm, or re-identify anonymised data without authorisation. Employees and contractors should be trained on these personal risks.
The DNC provisions require organisations to check the DNC Register before sending marketing messages by call, SMS or fax to Singapore numbers, unless they hold clear and unambiguous consent. Using dictionary attacks or address-harvesting software to generate numbers is prohibited.
Risks and common mistakes
Treating the privacy policy as the compliance programme
A well-drafted website policy is necessary but nowhere near sufficient. PDPC expects internal policies, staff training, a functioning DPO and evidence that controls work. When investigators review a breach, they look at what the organisation actually did: who had access, whether passwords were enforced, how vendors were monitored. A policy that promises encryption the business never implemented can make matters worse, because it shows the gap was known. Align the public notice with an internal operating policy and test the two against each other at least once a year.
Collecting NRIC numbers and copies by default
PDPC's advisory guidelines restrict the collection, use and disclosure of NRIC numbers and physical NRIC cards to situations where it is required by law or necessary to establish or verify identity to a high degree of fidelity. Many visitor management systems, membership sign-ups and retail promotions still ask for full NRIC numbers out of habit. Review every form and system that captures national identification numbers, replace them with alternatives where possible, and record the justification where collection remains necessary.
Keeping everything forever
Retention limitation is one of the least respected obligations and one of the most expensive to ignore. Every legacy database or old export increases the size of any breach and the cost of responding to access requests. Agree a retention schedule that reflects legal requirements, such as tax and employment record-keeping, and genuine business needs. Then implement deletion or anonymisation, including backups and vendor copies where feasible. A documented schedule that is partly implemented is far better than none.
Using customer data for AI without an assessment
Training or fine-tuning models on customer or employee data is a new purpose that needs a legal basis. The business improvement and research exceptions can help, but only within their conditions and usually alongside anonymisation or pseudonymisation. PDPC's guidelines on personal data in AI recommendation and decision systems also expect transparency about how such systems use data. Our AI governance team works on these assessments with product and data science teams.
Signing vendor terms without data clauses
Standard software and cloud terms often say little about breach notification timing, sub-processors, audit rights or deletion on exit. If a vendor suffers an incident and delays telling you, your own assessment and notification clock may already be running. Negotiate a short contractual deadline for the vendor to notify you, cooperation obligations, rights to information, and return or deletion of data at the end of the relationship.
The cross-border angle: Bangladesh, the UK, UAE, China and ASEAN
Many groups headquartered in Singapore process data across the region, and PDPA compliance in Singapore is often only one layer. The question is not which law applies but how to design one programme that satisfies several.
For the United Kingdom, UK GDPR and the Data Protection Act 2018 impose stricter rules on lawful bases, data subject rights and international transfers, as updated by the Data (Use and Access) Act 2025. Transfers from the UK to Singapore need a UK transfer mechanism, such as the International Data Transfer Agreement or Addendum.
In the UAE, the federal Personal Data Protection Law applies onshore, while the DIFC and ADGM have their own data protection regimes with separate regulators. Groups with a Dubai entity often need to satisfy both onshore and free-zone rules.
China's Personal Information Protection Law requires a security assessment, a standard contract filing or certification for outbound transfers, subject to later exemptions. Data flowing from China into Singapore must clear those gates before Singapore law becomes relevant.
Bangladesh is developing its own data protection framework, and groups with operations or outsourced teams in Dhaka, Chattogram or Sylhet should track it closely. Where foreign law governs, we coordinate with local counsel in each jurisdiction so that group policies, transfer contracts and breach plans work together.
Build the group programme to the strictest common standard where it costs little, such as transparent notices and breach logs, and localise only where laws genuinely diverge, such as transfer mechanisms and notification deadlines. That keeps one policy set rather than five.
How TRW & Co helps with PDPA compliance in Singapore
We work as advisers and programme coordinators, alongside your DPO, IT and security teams. Where Singapore court or tribunal representation is required, we work alongside Singapore-qualified counsel.
Gap assessment
We review data inventories, notices, policies and vendor contracts against the Act and PDPC guidelines, and deliver a prioritised remediation plan with owners and dates.
Documentation and contracts
We draft privacy notices, internal policies, legitimate interests and deemed consent assessments, data processing agreements and transfer clauses that reflect how the business actually operates.
Incidents and regulator contact
We support breach assessment and notification, prepare responses to PDPC queries and help structure voluntary undertakings. See our data breach response page.
Transactions and products
We run data protection due diligence in investments and acquisitions and advise on new products, from loyalty schemes to AI features, before launch.
To see how this connects with our wider work, visit our practices, or contact us to discuss your organisation's position.
Checklist for decision-makers
- Do we have a current data inventory showing what personal data we hold, where, and which vendors process it?
- Is there a named DPO with publicly available business contact details and real authority?
- Have we recorded the legal basis for each purpose, including written assessments for deemed consent by notification and legitimate interests?
- Do our privacy notices match what the business actually does with data?
- Do all data intermediary contracts cover protection, retention, sub-processing and prompt breach notification?
- Are overseas transfers covered by contracts, binding corporate rules or recognised certifications?
- Is there a retention schedule that is actually implemented, including backups?
- Have we tested the breach response plan against the 30-day assessment and three-day notification deadlines?
- Are marketing lists checked against the DNC Register where required?
An organisation that can answer yes to each question, and produce the documents behind each answer, is in a strong position for PDPA compliance in Singapore, and for any PDPC inquiry that follows an incident.
Frequently asked questions
01Does the PDPA apply to a foreign company with no office in Singapore?
It can. The Act applies to organisations that collect, use or disclose personal data in Singapore, and it does not depend on incorporation or a physical office here. An overseas business that markets to Singapore residents and collects their data online may need to comply. The practical approach is to map which activities touch Singapore individuals, apply the obligations to those flows, and appoint a contact who can answer PDPC and individuals. Group-wide policies that already meet stricter regimes often need only targeted adjustments for Singapore-specific rules such as the DNC provisions.
02Do we need consent to use customer data to improve our products?
Not always. Since February 2021, the business improvement exception lets organisations use personal data without consent to improve or develop products, services and operations, or to understand customers, provided the purpose cannot reasonably be achieved with anonymised data and a reasonable person would consider the use appropriate. It covers use, and sharing within a group in some cases, but not disclosure to unrelated third parties. Direct marketing is outside it. Document why the exception applies and what safeguards, such as pseudonymisation, are in place before you start.
03How quickly must we answer an access request?
PDPC expects organisations to respond as soon as reasonably possible. Where you cannot respond within 30 days, you should tell the individual in writing within that period when you will be able to respond. You may charge a reasonable fee to cover the incremental cost of responding, but should give an estimate first. Some information can be withheld under exceptions, such as opinion data kept for evaluative purposes or data that would reveal another person’s personal data. Keep a log of requests, responses and any exceptions relied upon.
04Is a data protection impact assessment mandatory under the PDPA?
There is no general statutory requirement to carry out a DPIA. However, the Act does require written assessments before relying on deemed consent by notification or the legitimate interests exception, and PDPC guidance recommends DPIAs for new systems and processes that involve personal data. In practice, a DPIA is the most efficient way to capture the analysis PDPC will expect to see. For higher-risk projects, such as large-scale profiling or AI systems, treat it as essential rather than optional.
05Can we send marketing messages to existing customers?
It depends on the channel and the consent you hold. For calls, SMS and fax to Singapore numbers, the DNC provisions require you to check the DNC Register unless you hold clear and unambiguous consent in evidential form, and to identify yourself and provide contact details. Email marketing falls under the Spam Control Act 2007 and needs an unsubscribe facility. Under the data protection provisions, using personal data for marketing also needs consent; deemed consent by notification cannot be used for direct marketing. Keep consent records linked to each contact.
06What happens if our vendor causes a breach?
You remain responsible for the personal data your vendor processes on your behalf, and PDPC will look at whether you selected, contracted with and monitored the vendor appropriately. The vendor, as data intermediary, has its own protection obligation and must notify you of breaches without undue delay. You then carry out the assessment and any notification. A strong contract, with security standards, a short notification deadline, cooperation duties and audit rights, is your main protection, together with records showing you checked the vendor’s controls.
07What is the maximum penalty for breaching the PDPA?
For breaches of the data protection obligations, PDPC can impose a financial penalty of up to S$1 million or, where the organisation’s annual turnover in Singapore exceeds S$10 million, up to 10% of that turnover, whichever is higher. Penalties are calibrated to factors including the nature and severity of the breach, the number of individuals affected, and the organisation’s cooperation and remediation. PDPC can also give directions, accept voluntary undertakings, and individuals who suffer loss may bring a private action. Separate offences apply to individuals who mishandle data.
Sources and official materials
- Personal Data Protection Act 2012 — The Act, as amended, on Singapore Statutes Online
- PDPC: Amendments to enforcement under the PDPA — Higher financial penalties from 1 October 2022
- PDPC: Guide on Managing and Notifying Data Breaches — Assessment and notification under the PDPA
- Personal Data Protection Commission — Advisory guidelines, decisions and DNC Register
- CSA: Overview of cybersecurity, personal data and computer misuse legislation — How the PDPA fits with other cyber laws
- MAS: Third-party risk management — Outsourcing expectations for financial institutions
General information only, current as at 20 October 2026. It is not legal advice and does not create a lawyer–client relationship. Singapore law and regulatory practice change; check current official sources and take advice on the facts of your matter.
Talk it through
before you decide.
Share the decision, the jurisdictions and the timetable. A partner will tell you what matters, what can wait and what it will take.