Two-minute brief
Singapore PDPA requirements explained: video brief
A two-minute brief on the named data protection obligations of Singapore's Personal Data Protection Act and the Do Not Call provisions.
Key takeaways
- Accountability includes a publicly contactable data protection officer.
- Consent and notification apply before collection, use or disclosure.
- Notifiable data breaches are reported to the PDPC.
- Transfers outside Singapore are limited by the Act.
- The Do Not Call provisions apply to marketing to Singapore numbers.
Named obligations
The Personal Data Protection Commission presents the PDPA's data protection provisions as a set of named obligations, with the Do Not Call provisions beside them. This short film walks through them. Legal interpretation stays with legal advisers.
Accountability asks an organisation to designate one or more individuals to be responsible for its compliance, make the data protection officer's business contact information available to the public, and make its data protection policies, practices and complaints process available on request. Notification asks it to tell individuals the purposes for which it intends to collect, use or disclose their personal data. Consent requires agreement before collection, use or disclosure, unless an exception applies, and allows consent to be withdrawn. Purpose limitation keeps use to purposes a reasonable person would consider appropriate.
Care of the data and the Do Not Call rules
Access and correction give individuals the right to see personal data held about them and how it has been used, and to have errors corrected. Accuracy requires reasonable effort to keep data accurate and complete when it is used for decisions. Protection requires reasonable security arrangements. Retention limitation means data is not kept once the purpose is served and retention is no longer needed. Transfer limitation governs transfers outside Singapore, and data breach notification requires notifiable breaches to be reported to the Commission and, in some cases, to affected individuals. Data portability starts only when its regulations are issued.
The Do Not Call provisions govern marketing messages to Singapore telephone numbers and the checking of the DNC Registry. The Act applies to organisations that collect, use or disclose personal data in Singapore, wherever they are based; data intermediaries carry narrower duties and public agencies are excluded. No certificate proves compliance; the Data Protection Trustmark is a voluntary certification by IMDA-appointed certification bodies.
Every organisation must designate at least one data protection officer and make that person's business contact information publicly available.
PDPA (Singapore) at a glance
- Purpose
- Data protection in Singapore: personal data collected, used, disclosed and cared for on the Act's terms, with accountability you can demonstrate
- Relevant to
- Organisations that collect, use or disclose personal data in Singapore, wherever they are based; data intermediaries carry narrower duties and public agencies are excluded
- Edition
- Personal Data Protection Act 2012, as amended by the Personal Data Protection (Amendment) Act 2020, in force in phases from 1 February 2021; data portability starts only when its regulations are issued
- Certification
- None for the Act itself, which the PDPC administers and enforces. The Data Protection Trustmark (DPTM) is a voluntary certification by certification bodies that IMDA appoints
- Sterling's role
- Programme design and consulting with your team, Effivity, training, internal audit and DPTM readiness where wanted, then Sustain™
- Cost and timing
- Total investment for a PDPA compliance programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 2 to 6 months
PDPA (Singapore): questions people ask
Is there a PDPA certification?
Not for the Act itself: compliance is a legal obligation the PDPC enforces, and no certificate discharges it. The nearest equivalent is the Data Protection Trustmark (DPTM), a voluntary, enterprise-wide certification in which a certification body appointed by IMDA assesses your practices against the DPTM requirements; the Act applies whether or not you hold it. ISO/IEC 27701 and ISO/IEC 27001 certificates, commonly aligned in practice with PDPA programmes, evidence a managed system, not legal compliance.
We have no office in Singapore. Does the PDPA apply to us?
It can. The Act applies to organisations that collect, use or disclose personal data in Singapore, whether or not they are formed or recognised under Singapore law or have any physical presence there. If you only process data for a Singapore client under a written contract, the narrower data intermediary obligations apply to that processing.
Do we need a data protection officer?
Yes. Every organisation must designate one or more individuals to be responsible for ensuring that it complies with the Act, and make the DPO's business contact information available to the public. In practice the DPO needs the authority, time and information to do the job, and the appointment should be documented.
What must we do when we discover a data breach?
Contain it, then assess whether it is notifiable, which the PDPC's guide expects within 30 calendar days of credible grounds to believe a breach occurred. It is notifiable if it results in, or is likely to result in, significant harm to affected individuals, or affects 500 or more of them. Notify the PDPC as soon as practicable and no later than three calendar days after that determination, and affected individuals where required, at the same time or afterwards. Record every incident and its assessment, including those judged not notifiable.
We process personal data for Singapore clients. Which obligations apply to us?
When you process personal data on behalf of another organisation under a contract evidenced or made in writing, you act as a data intermediary for that processing: the Protection and Retention Limitation Obligations apply, and you must notify the organisation of a data breach you detect. The full Act still applies to personal data you handle for your own purposes, such as your employees' records.
Keep exploring
Related to this video
The complete guide
Everything on PDPA (Singapore)
Start with the PDPA (Singapore) page, or go straight to the guide you need.
On the PDPA (Singapore) page
More videos: Privacy and data protection
- How to comply with Saudi Arabia's PDPLCompliance walkthrough · 3 min 15 s
- Saudi PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with the UAE PDPLCompliance walkthrough · 3 min 15 s
- UAE PDPL requirements explainedTwo-minute brief · 2 min
- How to comply with HIPAACompliance walkthrough · 3 min 24 s
- HIPAA requirements explainedTwo-minute brief · 2 min
- How to implement ISO/IEC 27701Implementation walkthrough · 3 min 14 s
- ISO/IEC 27701 requirements explainedTwo-minute brief · 2 min
- How to comply with GDPRCompliance walkthrough · 3 min 24 s
Talk to a consultant
Plan your PDPA compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice