Compliance walkthrough
How to comply with Singapore's PDPA: video walkthrough
A walkthrough of building a compliance programme for Singapore's Personal Data Protection Act 2012, with accountability an organisation can demonstrate.
Key takeaways
- The PDPA governs personal data collected, used or disclosed in Singapore.
- Accountability requires a designated data protection officer with public contact details.
- Each named obligation needs its own controls and evidence.
- The Do Not Call provisions cover marketing to Singapore numbers.
- There is no PDPA certificate; the DPTM is a separate voluntary certification.
Singapore's baseline for personal data
The Personal Data Protection Act 2012 is Singapore's general law on personal data held by organisations. It sets a baseline for how personal data, in electronic or paper form, is collected, used, disclosed and cared for, gives individuals the right to see and correct what is held about them, and contains the Do Not Call provisions behind the DNC Registry. The Personal Data Protection Commission administers and enforces it.
No certificate proves PDPA compliance. The Act works through accountability: each organisation designates people responsible for compliance and must be able to show how it meets its obligations. The Data Protection Trustmark is a separate, voluntary certification by certification bodies that IMDA appoints. This short film walks through how a programme is built.
Designed, operated and shown to work
Define what the programme needs to cover: the entities, where personal data is collected in Singapore, whether the organisation acts as a data intermediary, who will be data protection officer, and whether it telemarkets to Singapore numbers. A gap analysis then compares current practice with each named obligation.
Implementation works through the obligations. Accountability means a documented DPO appointment, business contact details made public, and policies, practices and a complaints process available on request. Notification and consent mean individuals are told the purposes for which their data is collected, used or disclosed, and agree where consent is the basis. Purpose limitation, access and correction, accuracy, protection, retention limitation, transfer limitation and data breach notification each have their own controls and records. The Do Not Call provisions apply to marketing messages to Singapore numbers. The programme then runs, and its evidence is kept so it can be shown to the PDPC if a complaint or breach arises, to clients, and to a Trustmark certification body if the organisation seeks the DPTM.
Sterling's expert and experienced consultants design and implement the programme with your team under Sterling OS™. Legal interpretation stays with your advisers.
PDPA (Singapore) at a glance
- Purpose
- Data protection in Singapore: personal data collected, used, disclosed and cared for on the Act's terms, with accountability you can demonstrate
- Relevant to
- Organisations that collect, use or disclose personal data in Singapore, wherever they are based; data intermediaries carry narrower duties and public agencies are excluded
- Edition
- Personal Data Protection Act 2012, as amended by the Personal Data Protection (Amendment) Act 2020, in force in phases from 1 February 2021; data portability starts only when its regulations are issued
- Certification
- None for the Act itself, which the PDPC administers and enforces. The Data Protection Trustmark (DPTM) is a voluntary certification by certification bodies that IMDA appoints
- Sterling's role
- Programme design and consulting with your team, Effivity, training, internal audit and DPTM readiness where wanted, then Sustain™
- Cost and timing
- Total investment for a PDPA compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 2 to 6 months
PDPA (Singapore): questions people ask
Is there a PDPA certification?
Not for the Act itself: compliance is a legal obligation the PDPC enforces, and no certificate discharges it. The nearest equivalent is the Data Protection Trustmark (DPTM), a voluntary, enterprise-wide certification in which a certification body appointed by IMDA assesses your practices against the DPTM requirements; the Act applies whether or not you hold it. ISO/IEC 27701 and ISO/IEC 27001 certificates, commonly aligned in practice with PDPA programmes, evidence a managed system, not legal compliance.
We have no office in Singapore. Does the PDPA apply to us?
It can. The Act applies to organisations that collect, use or disclose personal data in Singapore, whether or not they are formed or recognised under Singapore law or have any physical presence there. If you only process data for a Singapore client under a written contract, the narrower data intermediary obligations apply to that processing.
Do we need a data protection officer?
Yes. Every organisation must designate one or more individuals to be responsible for ensuring that it complies with the Act, and make the DPO's business contact information available to the public. In practice the DPO needs the authority, time and information to do the job, and the appointment should be documented.
What must we do when we discover a data breach?
Contain it, then assess whether it is notifiable, which the PDPC's guide expects within 30 calendar days of credible grounds to believe a breach occurred. It is notifiable if it results in, or is likely to result in, significant harm to affected individuals, or affects 500 or more of them. Notify the PDPC as soon as practicable and no later than three calendar days after that determination, and affected individuals where required, at the same time or afterwards. Record every incident and its assessment, including those judged not notifiable.
We process personal data for Singapore clients. Which obligations apply to us?
When you process personal data on behalf of another organisation under a contract evidenced or made in writing, you act as a data intermediary for that processing: the Protection and Retention Limitation Obligations apply, and you must notify the organisation of a data breach you detect. The full Act still applies to personal data you handle for your own purposes, such as your employees' records.
Keep exploring
Related to this video
The complete guide
Everything on PDPA (Singapore)
Start with the PDPA (Singapore) page, or go straight to the guide you need.
On the PDPA (Singapore) page
More videos: Privacy and data protection
- How to comply with Saudi Arabia's PDPLCompliance walkthrough · 3 min 15 s
- Saudi PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE PDPLCompliance walkthrough · 3 min 15 s
- UAE PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with HIPAACompliance walkthrough · 3 min 24 s
- HIPAA requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27701Implementation walkthrough · 3 min 14 s
- ISO/IEC 27701 requirements explainedTwo-minute brief · 2 min
- How to comply with GDPRCompliance walkthrough · 3 min 24 s
Talk to a consultant
Plan your PDPA compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice