Singapore's PDPA: A Practical Compliance Guide for Businesses

Singapore's Personal Data Protection Act 2012 (PDPA) governs the collection, use, disclosure and care of personal data in Singapore. Administered by the Personal Data Protection Commission (PDPC), the PDPA is one of the most mature data protection frameworks in Asia-Pacific. Significant amendments in 2021 strengthened the law - including mandatory breach notification, new individual rights, and significantly higher penalties. Here is what your business needs to know.

Overview of the PDPA and its scope

The PDPA applies to organisations that collect, use or disclose personal data of individuals in Singapore in the course of their activities. This includes foreign organisations that collect data from individuals in Singapore, even if the organisation has no physical presence in Singapore.

The PDPA does not apply to: public agencies (government bodies have their own framework); data processed for personal or domestic purposes; and employee data in an employment context (which is regulated separately under employment law, not the PDPA).

• Any business with Singapore customers or users falls within the PDPA's scope
• Data collected via websites, apps or online services from Singapore users is covered
• The PDPC can investigate complaints and impose financial penalties on organisations anywhere that collect Singapore residents' data

Key obligations under the PDPA

The PDPA establishes a set of data protection obligations for organisations:

• Consent obligation: obtain the individual's consent before collecting, using or disclosing their personal data - consent must be voluntary, informed and given for a specific purpose
• Purpose limitation: collect, use and disclose personal data only for purposes that a reasonable person would consider appropriate in the circumstances
• Notification obligation: notify individuals of the purposes for which their personal data will be collected before or at the time of collection
• Access and correction: respond to data access and correction requests within 30 business days
• Accuracy: make reasonable efforts to ensure personal data collected is accurate and complete
• Protection: implement reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, disposal or similar risks
• Retention limitation: cease to retain personal data when no longer necessary for the purpose and no legal reason to retain
• Transfer limitation: require comparable protection of personal data transferred to overseas organisations
• Accountability: appoint a Data Protection Officer (DPO) and develop data protection policies

The Do Not Call (DNC) Registry

Alongside data protection, Singapore operates a Do Not Call (DNC) Registry that prohibits businesses from sending specified messages - including telemarketing calls, text messages, and fax messages - to Singapore telephone numbers registered on the DNC registry.

Before conducting any telemarketing campaign to Singapore numbers, you must check the numbers against the DNC registry. The DNC check must be done no more than 30 days before the message is sent.

• Specified messages include marketing via voice calls, text (SMS/MMS), and fax
• The prohibition applies to any number registered on the DNC - there is no exception for existing customers (unlike some other jurisdictions)
• Penalties for violations can reach S$10,000 per message for organisations
• Online and email marketing is not covered by the DNC - but PDPA consent requirements still apply

The 2021 PDPA amendments - what changed

The Personal Data Protection (Amendment) Act 2020, which took effect in stages through 2021, introduced significant changes:

• Mandatory breach notification: organisations must notify the PDPC of a notifiable data breach within 3 business days of assessing it as notifiable, and affected individuals without undue delay. A breach is notifiable if it involves 500 or more individuals, or if it is likely to result in significant harm
• Deemed consent by notification: organisations can collect and use personal data for new purposes by notifying individuals and giving them an opportunity to opt out - this is more flexible than requiring fresh consent in some circumstances
• Legitimate interests exception: organisations can now process personal data without consent where they have a legitimate interest and the processing is proportionate
• Significantly increased penalties: financial penalties for PDPA breaches increased to S$1 million or 10% of Singapore annual turnover (whichever is higher) for organisations with annual turnover over S$10 million
• Right to data portability: organisations may be directed by the PDPC to make data available to designated receiving organisations at the individual's request

Practical compliance steps

• Appoint a Data Protection Officer (DPO) - mandatory under the PDPA. The DPO's details must be made public (typically on your website)
• Develop and implement a data protection policy and make it available on request
• Conduct a data inventory to map personal data collected, stored and shared
• Review your consent mechanisms - ensure they are voluntary, specific and informed
• Implement a data breach response plan with the 3-business-day PDPC notification deadline in mind
• Check DNC registry compliance before any telemarketing activities in Singapore
• Train staff on PDPA obligations - the PDPC has free e-learning resources available
• Register with the PDPC's accountability agent programme if seeking certification of your data protection practices

Back to all guides