Singapore PDPA Compliance Guide (2026)

Who it applies to

• Wide definition of "organisation". It includes any individual, company or association, whether or not it is formed or resident in Singapore (s 2). Foreign companies that handle personal data in Singapore can therefore be caught.
• Not covered by the main obligations (s 4):
• individuals acting in a personal or domestic capacity
• employees acting in the course of their employment
• public agencies
• Data intermediaries. These process data for another organisation under a written contract. They are bound only by the protection and retention obligations (ss 24–25) and the duty to notify the organisation of a breach. The organisation remains responsible for data its intermediary processes "as if the personal data were processed by the organisation itself" (s 4(3)).
• Business contact information. This is largely excluded from the main obligations.
• Old records and the deceased. Records at least 100 years old are excluded, and limited protections apply to people who have been dead for 10 years or less.

Key requirements

Accountability (Part 3)

Under s 11–12, an organisation must:

• designate one or more individuals responsible for compliance
• publish the business contact information of at least one of them
• develop and implement policies and practices
• set up a complaints process
• communicate its policies to staff
• make information about its policies and complaints process available on request

Consent, purpose and notification (Part 4)

Part 4 sets out the rules on consent, purpose and notification:

• Consent. Collection, use or disclosure requires consent, deemed consent, or an exception authorised by the Act or another written law (s 13).
• Product conditions. You can't require consent beyond what is reasonable to provide the product or service, and consent obtained through deceptive practices is invalid (s 14).
• Deemed consent. This covers data voluntarily provided and data needed to conclude or perform contracts (s 15).
• Deemed consent by notification. This is available from 1 February 2021. It requires an assessment showing no likely adverse effect, plus notice and a reasonable opt-out period (s 15A).
• Withdrawal. Individuals can withdraw consent on reasonable notice. The organisation and its intermediaries must then stop the collection, use or disclosure (s 16).
• Exceptions. The First and Second Schedules list them, for example legitimate interests and business improvement (s 17).
• Purpose limitation and notification (ss 18 and 20). Employment-related processing has its own notification rule.

Care of personal data (Part 6)

Part 6 covers how data must be looked after:

• Protection (s 24): reasonable security arrangements against unauthorised access, use, disclosure, copying, modification or disposal, and against loss of storage media.
• Retention limitation (s 25): stop retaining data, or anonymise it, once its purpose is no longer served and there is no legal or business need to keep it.
• Transfer limitation (s 26): data can only be transferred outside Singapore in line with prescribed requirements that ensure comparable protection. The PDPC can grant exemptions.

Data breach notification (Part 6A)

Part 6A applies to breaches on or after 1 February 2021.

• Assess. Once you have reason to believe a breach has occurred, assess "in a reasonable and expeditious manner" whether it is notifiable. The PDPC guide expects this to happen within 30 calendar days, with every step documented (PDPC guide).
• What counts as notifiable. A breach is notifiable if it is likely to result in significant harm, which is deemed when prescribed data classes are involved. It is also notifiable if it is of significant scale, meaning 500 or more affected individuals (PDPC guide). Breaches confined within an organisation are not notifiable.
• Notify the PDPC as soon as practicable, and no later than 3 calendar days after the assessment.
• Notify affected individuals for significant-harm breaches. Do this at the same time as or after notifying the PDPC, unless remediation or prior technological measures such as encryption make harm unlikely, or a law enforcement agency or the PDPC instructs otherwise.
• Data intermediaries must notify the organisation "without undue delay".

Penalties and enforcement

Under s 48J, the PDPC can impose financial penalties for intentional or negligent breaches of Parts 3–6B:

• Organisations: up to 10% of annual Singapore turnover where that turnover exceeds S$10 million, or up to S$1 million otherwise. These caps apply to contraventions from 1 October 2022, and turnover is taken from the latest audited accounts.
• Do Not Call (Part 9) breaches by individuals: up to S$200,000.
• Factors the PDPC weighs: gravity, the type of data involved, any financial benefit, mitigation, prior breaches, and proportionality.

Certification process and timeline

The PDPA itself has no mandatory certification. The DPTM, administered by IMDA, is a voluntary, enterprise-wide certification of data protection practices (IMDA DPTM kit):

• Eligibility. Organisations formed or resident in Singapore can apply; public agencies can't.
• Process. An IMDA-appointed Assessment Body carries out the assessment. Any non-compliance found must be fixed within 2 months.
• Timeline. IMDA estimates the main steps take 3 to 5.5 months.
• Validity. Certification lasts 3 years. Re-certification must be applied for at least 9 months before expiry.
• Changes. Significant changes must be reported to IMDA.

Costs

According to the IMDA DPTM kit:

• Application fee: S$545 including GST, payable to IMDA and non-refundable.
• Assessment fee: varies with organisation size and the chosen Assessment Body.
• Re-certification: treated as a new application, so the fees apply again.

Mapping to related frameworks

• GDPR: similar accountability, security and breach duties. PDPA leans more on consent and deemed consent, while GDPR relies on lawful bases.
• ISO/IEC 27001: controls supporting s 24 protection.
• MAS TRM: relevant for financial institutions that are also regulated by MAS.
• NIST Privacy Framework: useful for structuring a privacy program.

Readiness checklist

1. Appoint and publish the contact details of your DPO, or of the person designated under s 11.
2. Map personal data flows, including overseas transfers and data intermediaries.
3. Review consent notices, purposes and any use of deemed consent by notification, including the adverse-effect assessments.
4. Put in place written contracts with data intermediaries, including breach notification obligations.
5. Implement reasonable security controls and a retention schedule.
6. Build a breach playbook covering the 30-day assessment, the 3-day PDPC notification and the 500-person threshold.
7. Train staff and make your policies and complaints process available.
8. Consider DPTM certification, and budget about 3 to 5.5 months for it.

Common pitfalls

• Assuming PDPA doesn't apply to overseas companies.
• Asking for more consent than the service needs.
• Failing to document breach assessment steps.
• Keeping data "just in case".
• Treating the PDPC deadline as 3 business days. It is 3 calendar days.

How AssureCore helps

• The Controls Register and Policy Management, with AI-assisted writing and gap analysis, help document PDPA policies.
• Evidence Management stores DPO notices, vendor contracts and breach assessment records, with expiry alerts.
• The Risk Register tracks data risks.
• Cross-framework Mapping links PDPA controls to ISO 27001 and GDPR.

Frequently asked questions

Official references

• Singapore Statutes Online – PDPA 2012 (ss 1–4)
• SSO – PDPA Part 3 (Accountability)
• SSO – PDPA Part 4 (Consent and purpose)
• SSO – PDPA ss 24–26
• SSO – PDPA Part 6A (Breach notification)
• SSO – PDPA s 48J (Financial penalties)
• PDPC – Guide on Managing and Notifying Data Breaches (2021)
• IMDA – DPTM Information Kit

Related frameworks

• GDPR guide
• UK GDPR guide
• CCPA guide
• HIPAA guide