Loading…
Region
Asia Pacific
Coverage
Full Coverage
Regulator
Personal Data Protection Commission
Max Penalty
S$1M or 10% of Singapore turnover
Singapore's Regulatory Landscape at a Glance
Singapore's framework combines the PDPA with rules on telemarketing and electronic messages, cybersecurity legislation for critical systems, and sector-specific requirements. Depending on its activities, an organisation may need to consider several of these alongside one another.
The requirements applicable to an organisation depend on its activities, sector, processing operations, and regulatory status.
- Jurisdiction
- Singapore
- Primary data protection framework
- Personal Data Protection Act 2012 (PDPA)
- Major amendment
- Personal Data Protection (Amendment) Act 2020
Key Regulations in Singapore
Personal Data Protection Act 2012 (PDPA)
The PDPA governs the collection, use, and disclosure of personal data by organisations in Singapore. It sets out a series of data protection obligations and is administered by the Personal Data Protection Commission (PDPC).
Depending on applicability, organisations may need to address:
- Consent, and the purposes for which personal data is collected, used, or disclosed.
- Notification of those purposes to individuals.
- Access and correction requests.
- Accuracy of personal data.
- Reasonable security arrangements.
- Retention limits.
- Limits on transferring personal data overseas.
- Data breach assessment and notification.
Organisations should assess the PDPA's scope and exceptions, including its treatment of business contact information and public agencies, before determining which obligations apply.
Personal Data Protection (Amendment) Act 2020
The 2020 amendments introduced mandatory data breach notification, expanded deemed consent, a legitimate interests exception, and stronger enforcement powers, with provisions taking effect in phases from February 2021.
Higher maximum financial penalties took effect in October 2022. A data portability obligation was also introduced but will apply only once it is brought into force.
Organisations should confirm which amended provisions are in force before relying on them.
Do Not Call Provisions
The PDPA's Do Not Call provisions restrict telemarketing calls, text messages, and faxes to Singapore telephone numbers listed on the Do Not Call Registry, unless clear and unambiguous consent has been obtained.
Organisations that market by phone or message should check numbers against the Registry and keep records of consent.
Spam Control Act 2007
The Spam Control Act regulates unsolicited commercial electronic messages sent in bulk, including email and certain messaging services.
It requires an unsubscribe facility and accurate labelling of messages, and applies alongside the PDPA for marketing communications.
Cybersecurity Act 2018
The Cybersecurity Act establishes a framework for protecting critical information infrastructure and gives the Cyber Security Agency of Singapore powers to prevent and respond to cybersecurity incidents.
Organisations within scope should coordinate cybersecurity incident reporting with personal data breach assessment where an incident may involve personal data.
Sector-Specific Regulatory Requirements
Businesses operating in regulated industries may face additional obligations beyond general data protection law.
Sector considerations:
- Financial services: Monetary Authority of Singapore notices and guidelines on technology risk management, outsourcing, and cyber hygiene may apply to regulated institutions.
- Healthcare: organisations should assess health-sector confidentiality and health information requirements alongside the PDPA.
- Telecommunications and media: Infocomm Media Development Authority requirements may be relevant to particular providers and services.
- Technology and digital services: businesses should evaluate online safety, consumer protection, and other legislation relevant to their services.
Who Needs to Comply With Singapore's Data Protection Laws?
The PDPA and related requirements may apply to:
Organisations in Singapore
Private-sector organisations that collect, use, or disclose personal data in Singapore.
International companies
Businesses based elsewhere that collect, use, or disclose personal data in Singapore, whether or not they have a presence there.
SaaS and technology providers
Data intermediaries processing personal data for other organisations, which have their own protection, retention, and breach-reporting duties.
E-commerce and marketing teams
Businesses that market by phone, message, or email, which should consider the Do Not Call provisions and the Spam Control Act.
Employers
Organisations handling employee records, recruitment data, and other employment-related personal data.
Financial institutions
Regulated institutions, which should also consider Monetary Authority of Singapore requirements.
The precise obligations depend on the organisation's role, processing activities, size, risk profile, and territorial scope.
Understanding Your Obligations Under the PDPA
Accountability and the Data Protection Officer
Every organisation must designate at least one individual as its Data Protection Officer, make that person's business contact information publicly available, and develop and implement data protection policies and practices.
The requirement to designate a Data Protection Officer applies to organisations of all sizes.
Consent, Purpose and Notification
Organisations should collect, use, or disclose personal data only with the individual's consent or where an exception applies, only for purposes a reasonable person would consider appropriate, and after notifying the individual of those purposes.
Access and Correction
On request, organisations must provide individuals with their personal data and information about how it has been used or disclosed in the past year, and correct errors or omissions, subject to the exceptions in the Act.
Data Breach Notification
Organisations must assess suspected data breaches promptly. A breach that results in, or is likely to result in, significant harm to individuals, or that affects 500 or more individuals, must be notified to the PDPC within three calendar days of that assessment, and to affected individuals where required.
Protection and Retention
Organisations must protect personal data with reasonable security arrangements and stop retaining it once the purpose for collection is no longer served and retention is not needed for legal or business purposes.
Overseas Transfers
Personal data may be transferred outside Singapore only if the recipient is bound by legally enforceable obligations that provide a comparable standard of protection. These can arise from contracts, binding corporate rules, the recipient's local law, or recognised certifications.
Individual Rights Under the PDPA
The PDPA gives individuals a number of rights and protections. Depending on the circumstances, these may include:
Right of Access
Individuals may request their personal data and information about how it has been used or disclosed in the past year.
Right of Correction
Individuals may ask for errors or omissions in their personal data to be corrected.
Withdrawal of Consent
Individuals may withdraw consent on reasonable notice, and should be told the likely consequences of doing so.
Notification of Purposes
Individuals should be told the purposes for which their personal data is collected, used, or disclosed.
Breach Notification
Individuals should be notified of a data breach that is likely to result in significant harm to them, subject to exceptions.
Data Portability
A right to have data transmitted to another organisation was introduced in 2020 but is not yet in force.
Organisations should assess the exceptions in the PDPA, and any applicable fees and response times, when handling requests.
Singapore's Regulatory Timeline
The PDPA has been implemented and strengthened in stages.
- October 2012
PDPA Passed
Singapore's Parliament passed the Personal Data Protection Act, creating a general data protection framework for the private sector.
- July 2014
Data Protection Obligations in Force
The PDPA's main data protection obligations took effect, following the earlier launch of the Do Not Call Registry.
- February 2021
Amendments Take Effect
The first phase of the 2020 amendments came into force, including mandatory data breach notification and expanded deemed consent.
- October 2022
Higher Penalties
Increased maximum financial penalties took effect, linked to an organisation's annual turnover in Singapore.
Important: not every provision of the 2020 amendments is in force. Confirm the status of each provision using official sources before changing your compliance programme.
Data Protection Authorities in Singapore
The Personal Data Protection Commission (PDPC) administers and enforces the PDPA. It issues advisory guidelines, investigates complaints and data breaches, and can give directions or accept voluntary undertakings from organisations.
Other authorities may be relevant depending on the activity, including the Cyber Security Agency of Singapore under the Cybersecurity Act and the Monetary Authority of Singapore for financial institutions.
Organisations should identify which authorities are relevant to their activities rather than assuming that the PDPC is the only one.
Penalties for Non-Compliance
For breaches of the data protection obligations, the PDPC can impose a financial penalty of up to S$1 million or, where an organisation's annual turnover in Singapore exceeds S$10 million, up to 10% of that turnover, whichever is higher.
The PDPC can also direct an organisation to stop collecting or using personal data, or to destroy data collected in breach of the Act. Separate penalties apply to breaches of the Do Not Call provisions, certain egregious mishandling of personal data by individuals is a criminal offence, and affected individuals may bring civil claims.
How RegulatoryBridge Supports Compliance in Singapore
RegulatoryBridge helps organisations assess Singapore's regulatory requirements and coordinate their compliance activities with wider international programmes.
PDPA Compliance Assessment
Review your data handling activities, notices, consent practices, policies, governance arrangements, and operational controls to identify potential gaps.
Data Protection Officer and Governance Assessment
Review how your Data Protection Officer function is set up, including responsibilities, public contact details, and supporting policies and practices.
Consent, Access and Correction
Review consent workflows, notifications, request-handling processes, and related documentation against the requirements applicable to you.
Breach Response and Incident Coordination
Evaluate breach assessment procedures, escalation responsibilities, PDPC notification readiness, and coordination between privacy, security, and legal teams.
Overseas Data Transfers
Assess data flows out of Singapore, transfer mechanisms, vendor relationships, and contractual controls against the PDPA's transfer requirements.
Sectoral Compliance Coordination
Help organise requirements across privacy, cybersecurity, financial services, and other regulatory frameworks relevant to your business.
Regulatory Monitoring
Monitor relevant developments and review compliance plans when legislation, PDPC guidelines, or enforcement decisions change.
The scope of support is tailored to the organisation's activities, risk profile, and applicable legal requirements.
Our Approach to Singapore Compliance
- 01
Identify Applicable Requirements
Assess your organisation's activities, role in processing personal data, industry, and connections to Singapore.
- 02
Map Regulatory Obligations
Identify applicable provisions, relevant authorities, effective dates, and sector-specific requirements.
- 03
Conduct a Gap Assessment
Review existing policies, notices, consent mechanisms, contracts, security controls, and operational processes.
- 04
Develop a Compliance Roadmap
Prioritise remediation activities and establish owners, milestones, documentation requirements, and implementation plans.
- 05
Maintain Ongoing Readiness
Review regulatory developments, reassess relevant obligations, and update compliance processes when required.
Frequently Asked Questions
Need PDPA support in Singapore?
We support your Data Protection Officer function, PDPC interactions, and breach response - so your global product team doesn't have to.