PDPA (Singapore) · Personal Data Protection Act 2012
PDPA compliance consulting in Singapore for data protection you can show, not just claim.
Build a compliance programme for Singapore's Personal Data Protection Act that holds up when a vendor review, a data breach or a PDPC enquiry tests it: a data protection officer designated, consent and its alternatives documented, requests answered, breaches assessed and, where notifiable, reported to the PDPC within three calendar days of that decision, and Do Not Call checks built into marketing. Sterling's expert and experienced consultants build it with your teams, from our Singapore office and in 60+ countries, and stay with you once it runs. We ensure a successful PDPA compliance programme for our clients.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced data protection consultants, advising on management systems across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling builds the data protection programme and the evidence; the PDPC enforces the Act
8,100+ client engagements in 60+ countries.
PDPA client experience
What it is
What is the PDPA and what does it require in Singapore?
The Personal Data Protection Act 2012 (PDPA) is Singapore's general law on personal data held by organisations. It sets a baseline for how personal data, in electronic or paper form, is collected, used, disclosed and cared for, gives individuals the right to see and correct what is held about them, and contains the Do Not Call provisions behind the DNC Registry. The Personal Data Protection Commission (PDPC), established on 2 January 2013, administers and enforces the Act and can impose financial penalties of up to 10% of annual turnover in Singapore where that turnover exceeds S$10 million, or up to S$1 million otherwise.
No certificate proves PDPA compliance. The Act works through accountability: each organisation designates one or more individuals as data protection officer (DPO), publishes the DPO's business contact information and makes its data protection policies, practices and complaints process available on request. A working programme is a set of decisions (why each use is permitted), documents (notices, policies, data intermediary contracts, retention and transfer records), controls and records that they operate. A privacy notice on the website is none of these.
Current text. The Personal Data Protection Act 2012, as amended by the Personal Data Protection (Amendment) Act 2020, is the law in force. Parliament passed the amendments on 2 November 2020 and they took effect in phases from 1 February 2021, adding among other things mandatory data breach notification under Part 6A, deemed consent by notification, a legitimate interests exception and offences for individuals who egregiously mishandle personal data. The data portability obligation they created takes effect only when its regulations are issued. The PDPC's Advisory Guidelines on Key Concepts in the PDPA (revised 16 May 2022) and its Guide on Managing and Notifying Data Breaches under the PDPA (revised 15 March 2021) set out how the Commission reads the obligations.
Who it is for
Who needs to comply with the PDPA?
The Act reaches any organisation that collects, uses or discloses personal data in Singapore, whether or not it is formed or recognised under Singapore law or physically present there: a shared service centre in Manila or a software company in Bengaluru with users in Singapore can be in scope. Public agencies, individuals acting in a personal or domestic capacity and employees acting in the course of their employment are excluded, and business contact information largely so. Organisations come to Sterling from four starting points:
- A client's vendor assessment asks how you protect its customers' data. Singapore banks, insurers, hospitals and platforms expect service providers to show security and retention controls, breach alerting and a written contract. A data intermediary that answers with evidence moves through procurement; one that answers with a template waits.
- You are based outside Singapore and serve people there. An online shop, an app, a recruitment campaign or a regional contact centre collecting personal data in Singapore brings the Act with it, and the Do Not Call rules for any telemarketing to Singapore numbers.
- You are a Singapore business that has never formalised it. There is a privacy notice and a DPO e-mail address, but nobody has mapped the personal data, set retention periods or rehearsed a breach. Growth, a new system or a complaint usually exposes the gap.
- A breach, a complaint or a PDPC enquiry has already happened. The urgent task is to assess and, where required, notify within the Act's timelines; the lasting one is to show the Commission and your clients that the causes are fixed.
Business benefits
How a PDPA programme protects customers, contracts and reputation
Personal data meets business risk at predictable moments: customer records e-mailed to the wrong address, a bank's vendor questionnaire, a former employee's access request, a campaign sent to numbers on the DNC Registry. We give each moment an owner, a procedure and a record.
- Breaches handled against the clockA rehearsed procedure that contains the incident, decides whether it is notifiable and, if so, reports to the PDPC within three calendar days of that decision, telling affected individuals where the Act requires it.
- Procurement that movesWritten data intermediary terms, protection and retention evidence and a breach escalation route, ready before a Singapore client's vendor review asks.
- Consent where it belongsDeemed consent by notification and the legitimate interests exception used only with their assessments, and real consent recorded with its wording, date and a working withdrawal route.
- Requests answered from an inventoryAccess and correction requests answered from a map of where each person's data sits, including how it was used or disclosed in the year before the request.
- Marketing that respects the registerTelemarketing lists checked against the DNC Registry before any message goes to a Singapore number, with the check kept on file.
- Accountability you can showA DPO with authority, policies available on request and a record behind each decision: your ground if the PDPC investigates, and the base for the Trustmark.
Track a handful of measures: days from breach discovery to the notifiability decision, access requests closed within your own target, data intermediary contracts signed, telemarketing lists checked before use. The number of policies is not one of them.
Requirements
What are the main PDPA requirements?
The PDPC presents the data protection provisions as a set of named obligations; the Do Not Call provisions sit beside them in Parts 9 and 9A. The table maps each to practice; your processing is checked against the Act, its regulations and the PDPC's guidelines, and legal interpretation stays with your advisers.
| Obligation | What it requires of you | What it looks like in practice |
|---|---|---|
| Accountability Policies, practices and the DPO | Designate one or more individuals to be responsible for your compliance, make the data protection officer's business contact information available to the public, and make your data protection policies, practices and complaints process available on request | A documented DPO appointment, contact details on the website, policies staff follow and a logged complaints route |
| Notification Purposes made known | Tell individuals the purposes for which you intend to collect, use or disclose their personal data | Notices at every collection point (forms, apps, CCTV, recruitment), kept in step with the data inventory |
| Consent Consent, deemed consent and exceptions | Collect, use or disclose personal data only for purposes the individual has consented to, unless consent is deemed or an exception applies; allow withdrawal on reasonable notice and explain the likely consequences; assess before relying on deemed consent by notification (section 15A) or the legitimate interests exception | The basis recorded per activity, consent records with wording and date, assessments on file, and withdrawals that reach every system |
| Purpose limitation Reasonable purposes only | Collect, use or disclose personal data only for purposes a reasonable person would consider appropriate in the circumstances and for which the individual has given consent, and do not demand consent beyond what is reasonable to provide the product or service | Each purpose tested against the reasonable person standard; optional uses kept separate |
| Access and correction Individuals' requests | On request, give individuals access to their personal data and to information about how it was used or disclosed within the year before the request; correct errors as soon as practicable and send the corrected data to organisations you disclosed it to within the year before the correction | A request procedure with identity checks and a log, and a way to find every record about one person |
| Accuracy Complete and correct data | Make a reasonable effort to ensure personal data is accurate and complete, particularly where it is likely to be used for a decision that affects the individual or disclosed to another organisation | Validation at capture, update routes, and checks before data feeds a credit, hiring or eligibility decision |
| Protection Reasonable security arrangements | Protect personal data in your possession or under your control with reasonable security arrangements against unauthorised access, collection, use, disclosure and similar risks | A personal data risk assessment and its controls, commonly aligned in practice with ISO/IEC 27001, plus access reviews, secure disposal and written terms for every data intermediary |
| Retention limitation Kept only while needed | Stop retaining personal data, or dispose of it properly, once it is no longer needed for any business or legal purpose | A retention schedule by record type, with disposal or anonymisation recorded, backups included |
| Transfer limitation Data leaving Singapore | Transfer personal data outside Singapore only in line with the requirements prescribed under the Act, which secure a standard of protection comparable to the PDPA's, unless the PDPC grants an exemption | A transfer map covering cloud hosting, group companies and offshore support, with the basis for each transfer recorded |
| Data breach notification Part 6A | On credible grounds to believe a breach has occurred, assess reasonably and expeditiously whether it is notifiable (the PDPC's guide expects this within 30 calendar days): it is if it results in, or is likely to result in, significant harm to affected individuals, or affects 500 or more of them; notify the PDPC as soon as practicable and no later than three calendar days after that determination, and affected individuals where required; data intermediaries notify the organisation they process for | An incident procedure on the PDPC's Contain, Assess, Report, Evaluate model, templates, a decision record per incident and a breach register, rehearsed yearly |
| Data portability Not yet in force | At an individual's request, transmit their data to another organisation in a commonly used machine-readable format; created by the 2020 amendments, it takes effect only when its regulations are issued | Nothing to implement yet; an inventory organised by system makes scoping easy when the regulations appear |
| Do Not Call Parts 9 and 9A | Respect the DNC Registry, where individuals register Singapore telephone numbers to opt out of telemarketing messages: check numbers against it before sending, and follow the Act's other telemarketing rules | A pre-campaign check with results kept, records of any consent relied on for a registered number, and marketing vendors bound by the same rules |
What does useful PDPA evidence look like?
An inventory that matches the systems people use, the DPO appointment and published contact, notices at collection points, the basis for each activity with its assessments, written contracts with every data intermediary, a retention schedule with disposal records, a transfer map, a request log, a breach register that includes incidents judged not notifiable and why, DNC check records and training records. We build these from how you actually handle personal data and keep them in Effivity from the first workshop, so anyone who checks sees a programme in operation.
PDPA requirements explained, obligation by obligationCompliance process
How do you become PDPA compliant?
A PDPA programme is designed, operated and then shown to work. Sterling builds it with your team; whether it meets the Act is for the PDPC to decide if a complaint or a breach brings you before it, while clients, and a DPTM certification body if you seek the Trustmark, judge the evidence you give them.
- 01Define what the programme needs to cover.Confirm the entities, where personal data is collected in Singapore, whether you act as a data intermediary, who will be DPO, whether you telemarket to Singapore numbers, and who will judge the result.
- 02Gap analysis: review the current position against the Act.The gap analysis maps personal data by system and purpose, tests notices, consents, contracts, controls and procedures against each obligation and the PDPC's guidelines, keeps what works and agrees actions, owners and dates.
- 03Put the programme into operation, and record it.Designate and publish the DPO, record the basis and assessments for each activity, sign data intermediary terms, set retention and transfer controls, build the breach and request procedures and train the people who handle personal data.
- 04Audit, review and close the findings.An internal audit against the Act and a management review with the DPO show what operates and what does not; we raise findings first, and each is closed with evidence.
- 05Complete the regulator or customer review.Answer a vendor assessment, a client audit or a PDPC enquiry from evidence that already exists, or take the programme to DPTM certification with an IMDA-appointed certification body.
- 06Keep the programme running.New systems and suppliers screened, requests and incidents reviewed, the inventory kept current, DNC checks before each campaign, and a yearly internal audit and management review.
Judge an offer by what your organisation will hold at the end: who maps the data, whether documents are drafted from your own processing, what your people will learn and where the evidence will live. A "PDPA certificate" from a consultancy or a training company is not a certification under the Act, which provides none. How to choose a credible PDPA provider · The certification buyer's checklist
Cost
How much does PDPA compliance cost?
The price of a PDPA programme follows the personal data you hold and how many systems, suppliers and people touch it: a twenty-person clinic and a contact centre processing for Singapore banks need very different programmes. In every Sterling proposal each component is visible and nothing is added later.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Processing activities, systems and data intermediaries to map, your role for each, entities and countries, deliverables, and how much of the work your team takes on (Design™ or Drive™) |
| Independent review | Fees of a DPTM certification body or other assessor you choose, shown separately; client audits and PDPC enquiries cost time, not fees |
| Internal resources and legal | DPO capacity, process-owner time for data mapping, IT effort for access, retention and security changes, training hours and any legal review of notices, contracts or transfers |
| Software and learning | Included in a Sterling engagement: Effivity for the programme and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, breach and request reviews, updates when the Act, its regulations or the PDPC's guidelines change, and refresher learning under Sustain™ |
What moves the price
- Processing activities, systems and data intermediaries, and whether data flows are already mapped
- Whether you process for clients as a data intermediary, for yourselves, or both
- Identity numbers, financial or medical records, which call for stronger controls
- Countries in scope: Singapore alone, or the GDPR, India's DPDP Act or the UAE's PDPL too
- The deadline set by a client, a contract or a Trustmark assessment
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Certification-body, assessor and legal fees identified separately, so the full programme cost is comparable
- Effivity, training and Academy access itemised at no additional cost
- Payment milestones tied to deliverables, not to the calendar
- One all-inclusive proposal. No surprises, ever
Timeline
How long does PDPA compliance take?
Two to six months is realistic: a single Singapore entity with a clear picture of its data at the short end, a group with several entities, offshore processing and many data intermediaries at the long end. Drafting rarely holds a programme up; decisions on consent bases, retention and transfers do, and procedures must run long enough to leave records. We plan around those decisions, with milestones in Effivity.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to system owners, contracts and records, and how quickly the personal data inventory is completed |
| Build and implementation | Decisions on consent bases and retention, data intermediary terms, IT changes for access, disposal and security, and training |
| Evidence and review | Procedures operating long enough to generate records, a breach rehearsal, then internal audit and management review |
| Regulator or customer review | The timing of client audits and vendor reviews and, for the Trustmark, the certification body's schedule |
If a client audit, a contract date or a Trustmark assessment is already fixed, tell us at the start and we will say what can be ready by then. Full PDPA compliance promised within a week, before anyone has seen your systems, is a sales line, not a plan.
Challenges
Common PDPA implementation challenges
PDPA programmes tend to stall on the same five problems. Each has a practical answer.
The DPO has the title but not the time or the information.
We define the role, its reporting line and its decisions, give it an inventory and a review calendar, and make sure the published contact reaches someone who answers; where the DPO has another job, the programme fits the hours available.
Nobody can say what personal data the organisation holds.
Department by department, we map collection points, systems, purposes, recipients, retention and transfers with the people who run them. The result feeds every notice, access request and retention decision.
Consent is collected for everything, or for nothing.
Some activities need consent; others can rest on deemed consent, including by notification, or on an exception such as legitimate interests, each assessed and on file. We settle each basis with you and your legal advisers and record the reasoning.
Vendors and group companies process data without written terms.
A data intermediary register, written terms covering protection, retention and breach escalation, and a transfer map for anything processed outside Singapore, highest-risk suppliers first.
Breaches are found late and decided by whoever is on shift.
One reporting route, a decision owner, a notifiability assessment against the harm and scale tests, the three-calendar-day clock to the PDPC and templates for the Commission and affected individuals, rehearsed before a real incident.
Your engagement
What your PDPA engagement includes
One scope, one all-inclusive proposal and one team cover everything the programme needs: mapping and decisions, documents, software, training and the audit that shows it runs.
Scope, gap analysis and implementation plan
Entities, systems, data intermediaries and telemarketing confirmed; each obligation tested against current practice; actions, owners and dates agreed before work begins.
Data inventory, decisions and documentation
The inventory, the basis and assessments per activity, notices, policies, the DPO role, data intermediary terms, retention and transfer records and the breach and request procedures, on Sterling's template sets adapted to you.
Effivity ISO & GRC software
Your PDPA programme runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed with evidence before a client, a Trustmark assessor or the PDPC looks.
Review readiness and support
Preparation for vendor reviews, client audits and PDPC enquiries, and support through DPTM certification if you pursue it.
The PDPC administers and enforces the Act, and DPTM certification decisions rest with the certification body. Sterling's work is consulting, not legal advice.
How we deliver
How Sterling supports your PDPA implementation
Every PDPA engagement runs on Sterling OS™, our delivery operating system: five phases, each with deliverables, decision owners and evidence. How much of the work your team carries is your choice; the method, software and accountability stay the same.
- 01Design™Guided implementation: your DPO and process owners do the work, with Sterling's structure, templates, workshops and coaching behind them.
- 02Drive™Fully managed consulting: Sterling consultants carry the mapping, drafting, assessments and contract work alongside your teams and legal advisers.
- 03Sustain™Operation after go-live: breach and request reviews, the yearly internal audit, DNC and retention checks, refreshers and new-hire training.
- 04Automate™The programme in Effivity: inventory, assessments, data intermediaries, requests, breaches, transfers, audits and management review in one workspace.
- 05Revise™Changes in law and guidance, such as the data portability regulations when they are issued or revised PDPC guidelines, and changes in your entities, systems or countries.
In the first week we agree the engagement team, the weekly working session, the deliverables and who decides what; progress is reviewed against them, so a slipping action shows early, not at a client's audit.
How Sterling OS™ worksOften combined with
Standards organisations pair with PDPA (Singapore)
- ADGM Data Protection Regulations 2021ADGM data protection compliance for entities under the 2021 Regulations: lawful bases, DPO, impact assessments, 72-hour breach notice and transfers, all-inclusive proposal.
- APEC CBPRAPEC CBPR certification and requirements explained: Global CBPR and PRP, Accountability Agent review, annual renewal and how Sterling prepares your team.
- APPI (Japan)APPI compliance for Japan's Act on the Protection of Personal Information: the requirements, PPC breach reporting, cross-border rules and an all-inclusive programme.
- Bahrain PDPLBahrain PDPL compliance and requirements explained: consent, notification to the Authority, transfers abroad, 72-hour breach reporting, rights, cost and timing.
- CCPA / CPRACCPA compliance and requirements under the CPRA: notices, consumer rights, opt-outs, risk assessments, cybersecurity audits and ADMT, in an all-inclusive programme.
- Cyber and Data Protection Act (Zimbabwe)Zimbabwe's Cyber and Data Protection Act [Chapter 12:07]: POTRAZ licensing, lawful processing, security and transfers, built into a programme.
Effivity · PDPA programme software, included in every engagement
How Effivity helps you fulfil, automate and simplify the requirements of the PDPA.
Every Sterling PDPA engagement includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the workspace within the agreed scope, so the inventory, the basis and assessments for each activity, data intermediaries, transfers, requests, breaches, DNC checks, training, audits and management review sit in one place and run in daily use, not in a file assembled the week before. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
The DPO, policies and complaints
The DPO appointment and published contact, the policies and practices you would show on request, and a complaints log with responses and dates: accountability as a record, not a statement.
Purposes, notices and the basis for each activity
Each activity carries its purposes, the notice that told people and whether it rests on consent, deemed consent or an exception, with consent records, withdrawals and assessments attached.
Requests logged and answered
One log for access and correction requests, with identity checks, response dates, the use and disclosure information supplied and corrections passed on to recipients of the data.
Risks, controls and data intermediaries
A personal data risk register linked to the controls that treat each risk, and a data intermediary register with contract status, security evidence and review dates.
Retention schedule and disposal records
Retention periods by record type with the business or legal reason for each, and disposal or anonymisation recorded when a period ends, backups included.
The transfer map
Every flow of personal data out of Singapore, to cloud hosts, group companies or offshore teams, with the basis relied on and a review when a supplier, country or contract changes.
Incidents, assessments and the three-day clock
An incident workflow on the Contain, Assess, Report, Evaluate model, the notifiability assessment against the harm and scale tests, the three-calendar-day deadline to the PDPC, templates and the breach register.
Audits, training, DNC checks and management review
Internal audits and findings, learner records from Sterling Academy, the DNC Registry check behind each telemarketing campaign and a management review that minutes its decisions; forms and reports shaped to you without code.
What this means at the audit
A client's auditor asks for the DPO appointment, the data intermediary contract, the last breach assessment and the training records; the PDPC, looking into a complaint or a breach, asks how the obligations were met. In Effivity each answer is a screen with dates, owners and evidence. Sustain™ runs in the same workspace, so the next vendor review meets a programme that kept running.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Your inventory, registers and records migrated, not retyped
- Admin and user training for your team
- Modules for ISMS, PIMS, QMS, BCMS and more when you integrate other standards
PDPA client experience
Client letters on file, available on request.
Signed client letters for PDPA (Singapore) are available on request. The client feedback wall lists every letter by standard.
Programmes with the PDPA in scope
Where the PDPA sits in a wider privacy and security programme.
- 01How integrated programmes run
Service providers to Singapore clients: the PDPA inside one integrated programme
How such a programme typically runs: a contact centre, shared service centre or software provider processing personal data for Singapore clients keeps one inventory, one set of roles and one incident procedure, then layers on the PDPA's data intermediary duties, the GDPR where European clients are served, and ISO/IEC 27001 and ISO/IEC 27701 controls. One audit cycle and one management review cover them all, and every client's vendor review draws on the same evidence.
Sterling Academy · PDPA e-learning
Train every employee on the PDPA, not just the DPO.
Sterling Academy teaches both the whole workforce and the people who operate the programme: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- PDPA awareness for every employee, including what to do when a breach or a request appears
- Practitioner courses for the DPO, process owners and the people who handle requests and incidents
- Internal auditor training for the people who will audit the programme, as applicable to your standard, as part of the engagement
- Learner progress by department and a training report for any auditor or assessor
- New hires trained as they arrive, so evidence is current when the next vendor review lands
- A Sterling consultant reachable when a learner needs one
Where we work
Where Sterling delivers PDPA (Singapore)
Keep exploring
Explore more about PDPA (Singapore)
Watch a video on how to comply with Singapore PDPA here.
Watch a video on Singapore PDPA requirements here.
Why Sterling
Want successful PDPA compliance? Come to Sterling.
Whether you are a Singapore company putting its programme on a proper footing or a service provider abroad answering Singapore clients, Sterling builds one PDPA programme with clear local ownership. Our Singapore consultants work with colleagues across Sterling's offices in 21 countries, so a group operating in the Philippines, India, the UAE or Europe gets one programme for all the data protection laws it faces.
A Singapore office, and 60+ countries since 2003
Privacy and security programmes for service providers, technology, financial and healthcare organisations and manufacturers, with one engagement team accountable in every country you operate in.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with certification-body, assessor and legal fees identified separately. No surprises, ever.
A programme your people can run
Fewer documents, more control: inventory, procedures, training and software built around how personal data moves through your organisation, so staff follow the programme because it fits the work.
Expert and experienced consultants
Since 2003 our consultants have advised on privacy and information security management systems across sectors and countries, getting the programme right the first time so a vendor review or Trustmark assessment finds it already working.
The Sterling Promise
What our PDPA compliance success guarantee means
We stay with you until the agreed PDPA programme outcome is achieved: data mapped, the basis for each activity recorded, the DPO in place, procedures rehearsed and your team able to face the next vendor review, request or incident without us in the room. Clear explanations, practical delivery, included software and training turn the investment into capability rather than a policy folder.
The engagement defines the entities, scope, outcome and responsibilities. Your organisation supplies accurate information, gives access to the systems and contracts in scope and operates the agreed controls. The PDPC enforces the Act, and legal interpretation remains with your legal advisers. Our commitment covers the agreed programme support; it is not legal advice or a warranty against every breach, complaint or finding.
Once the programme is in place
What happens after your PDPA programme is in place?
The programme has to keep pace with the business. New systems, vendors, campaigns and markets change the processing, staff join and leave, and the law moves: data portability takes effect when its regulations are issued, and the PDPC revises its guidance. Each change passes through the inventory, the assessments, contract updates and the yearly audit and review.
Under Sterling OS™ Sustain™ we run that cycle with you: reviews of requests, incidents and DNC checks, regulatory updates, refresher training and the internal audit, so the programme is current whoever asks.
FAQs
Frequently asked questions about the PDPA
Is there a PDPA certification?
Not for the Act itself: compliance is a legal obligation the PDPC enforces, and no certificate discharges it. The nearest equivalent is the Data Protection Trustmark (DPTM), a voluntary, enterprise-wide certification in which a certification body appointed by IMDA assesses your practices against the DPTM requirements; the Act applies whether or not you hold it. ISO/IEC 27701 and ISO/IEC 27001 certificates, commonly aligned in practice with PDPA programmes, evidence a managed system, not legal compliance.
We have no office in Singapore. Does the PDPA apply to us?
It can. The Act applies to organisations that collect, use or disclose personal data in Singapore, whether or not they are formed or recognised under Singapore law or have any physical presence there. If you only process data for a Singapore client under a written contract, the narrower data intermediary obligations apply to that processing.
Do we need a data protection officer?
Yes. Every organisation must designate one or more individuals to be responsible for ensuring that it complies with the Act, and make the DPO's business contact information available to the public. In practice the DPO needs the authority, time and information to do the job, and the appointment should be documented.
What must we do when we discover a data breach?
Contain it, then assess whether it is notifiable, which the PDPC's guide expects within 30 calendar days of credible grounds to believe a breach occurred. It is notifiable if it results in, or is likely to result in, significant harm to affected individuals, or affects 500 or more of them. Notify the PDPC as soon as practicable and no later than three calendar days after that determination, and affected individuals where required, at the same time or afterwards. Record every incident and its assessment, including those judged not notifiable.
We process personal data for Singapore clients. Which obligations apply to us?
When you process personal data on behalf of another organisation under a contract evidenced or made in writing, you act as a data intermediary for that processing: the Protection and Retention Limitation Obligations apply, and you must notify the organisation of a data breach you detect. The full Act still applies to personal data you handle for your own purposes, such as your employees' records.
What penalties can the PDPC impose?
For breaches of the data protection provisions, financial penalties of up to 10% of annual turnover in Singapore for an organisation whose Singapore turnover exceeds S$10 million, or up to S$1 million otherwise. Individuals who egregiously mishandle personal data, such as by unauthorised disclosure or by re-identifying anonymised data, commit criminal offences. For smaller businesses, the PDPC may consider implementation of IMDA's Data Protection Essentials programme as a mitigating factor after a breach.
Does a GDPR programme already cover the PDPA?
Much carries over: inventory, notices, security controls, breach and request procedures and supplier contracts serve both laws. The PDPA differs in its deemed consent and exception rules, its breach test and three-calendar-day deadline, its data intermediary regime, its treatment of business contact information and its Do Not Call rules. We run one programme with a Singapore layer that records those differences.
We are a small business in Singapore. Is there a lighter starting point?
IMDA's Data Protection Essentials (DPE) programme is designed for SMEs registered and operating in Singapore: a one-time setup service covering accountability practices, basic data security, incident management and training, which can lead on to DPTM certification. With data intermediary contracts, several entities or processing outside Singapore, a full programme fits better; we will tell you which applies.
What do you need to prepare a PDPA proposal?
The entities involved, roughly how many systems and suppliers handle personal data, whether you process data for clients or telemarket to Singapore numbers, what exists today and any deadline from a client, a contract or a Trustmark assessment. That is enough for a scoped, all-inclusive proposal; you do not need to map your data first.
Before the first call
Prepare a useful PDPA readiness brief
Nothing needs mapping before the first call; a short account of the personal data in the business, and why the question has come up now, is enough. Seven questions cover it:
- What has prompted the question: a client's vendor review, a contract clause, a breach or complaint, a PDPC letter, or your own concern?
- Which entities collect, use or disclose personal data in Singapore, and do any of them process it for other organisations?
- Which systems, cloud services and suppliers hold that data, and does any of it leave Singapore?
- Do you handle identity numbers, financial or medical information or children's data, or telemarket to Singapore numbers?
- What exists already: a designated DPO, notices, a breach procedure, data intermediary contracts, an ISO/IEC 27001 system?
- Who can decide and give time: the DPO, legal counsel, IT, the process owners?
- Is there a client audit, a contract date or a Trustmark assessment to plan around?
From these answers we can set a realistic scope and all-inclusive proposal; the brief prepares a discussion, not a scored assessment or legal advice.
Don’t be fooled by certification scams
If it takes ten days, it is not PDPA compliance.
The PDPA has no certificate, and that gap is where shortcuts are sold: "PDPA certified" badges, a DPO course certificate passed off as proof the company complies, policy bundles written for somebody else, and a website privacy notice offered as the whole job. None survives a client's vendor review, a real breach or a PDPC investigation that asks for records.
How to choose a credible PDPA provider
- Ask what will exist when the work is done: an inventory, recorded decisions on consent and its alternatives, notices, data intermediary terms, breach and request procedures and trained people, and who produces each.
- Ask exactly what any certificate or badge on offer is. The Data Protection Trustmark is assessed by certification bodies that IMDA appoints; confirm the appointment with IMDA. A "PDPA certificate" from a consultancy or a training provider is not DPTM certification and no evidence that the Act has been met.
- Ask how the programme will be built from your actual processing, with your system owners and legal advisers, not from a questionnaire and a document pack.
- Identify who carries each task, which certification-body, assessor or legal costs are separate, and what help exists when a breach or a client audit tests the programme.
- Ask what your people will learn and where the evidence will live. Evidence held in the consultant's files walks out with the consultant.
- Walk away from compliance in a weekend, "PDPA certified" badges and a privacy notice presented as the whole programme. The Act holds your organisation accountable for everyday handling of personal data; no badge carries that for you.
Keep exploring
More on PDPA (Singapore) and related standards
More in Privacy & data protection
Talk to a consultant
Plan your PDPA compliance with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice