PDPA (Singapore)

What is Singapore’s PDPA?

The PDPA is Singapore’s general law on the collection, use and disclosure of personal data by private-sector organisations. It also contains the Do Not Call provisions on marketing messages. Public agencies are covered by separate rules.

Who does it apply to?

Organisations that collect, use or disclose personal data in Singapore, including those based overseas. Data intermediaries processing on behalf of another organisation have a narrower set of duties, mainly protection, retention and breach notification.

The data protection obligations

The PDPA is usually summarised as a set of obligations:

• Consent, with deemed consent and legitimate-interests exceptions introduced in 2020.
• Purpose limitation and notification of purposes.
• Access and correction.
• Accuracy.
• Protection: reasonable security arrangements.
• Retention limitation.
• Transfer limitation: comparable protection for data sent overseas.
• Data breach notification.
• Accountability: policies, practices and a Data Protection Officer.
• Data portability: legislated, with provisions to be brought into force.

Breach notification

Organisations must assess suspected breaches promptly. A breach is notifiable if it is likely to cause significant harm or affects 500 or more individuals. Notifiable breaches must be reported to the PDPC within three calendar days of the assessment, and affected individuals must also be informed where significant harm is likely.

Enforcement

The PDPC publishes enforcement decisions and can direct organisations to comply and impose financial penalties of up to 10% of annual turnover in Singapore for organisations with turnover above S$10 million, or S$1 million otherwise.

How does it relate to other frameworks?

Financial institutions in Singapore also follow MAS technology risk requirements. PDPC’s Data Protection Trustmark certification provides an independent attestation option.