Personal Data Protection Act
Singapore's data protection law, balancing individual rights with the country's data-driven economy. It's enforced by the PDPC, which also promotes data protection certification and guidance for businesses.
Who it applies to
- Organisations collecting, using or disclosing personal data in Singapore
- Both private-sector organisations and, for certain provisions, public agencies
- Organisations processing data for commercial purposes
Key requirements
- Consent or a permitted exception before collecting personal data
- A Data Protection Officer designated and contactable
- Mandatory breach notification to the PDPC for notifiable breaches
- Reasonable security arrangements proportionate to risk
- Data Protection Impact Assessments encouraged for higher-risk processing
Maximum penaltyFinancial penalties up to 10% of annual turnover in Singapore, or S$1 million, whichever is higher
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
Singapore's PDPA applies to: Organisations collecting, using or disclosing personal data in Singapore; Both private-sector organisations and, for certain provisions, public agencies; Organisations processing data for commercial purposes.
The core obligations are: Consent or a permitted exception before collecting personal data; A Data Protection Officer designated and contactable; Mandatory breach notification to the PDPC for notifiable breaches; Reasonable security arrangements proportionate to risk; Data Protection Impact Assessments encouraged for higher-risk processing. Each is summarised in plain English above, with a link to the official text.
Effective: 2012, substantially amended 2021. Regulator: Personal Data Protection Commission (PDPC).
Financial penalties up to 10% of annual turnover in Singapore, or S$1 million, whichever is higher.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under Singapore's PDPA, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator. Alongside it, where Singapore's PDPA expects a Data Protection Officer, DPO as a Service can provide a named, accredited one; rights requests and consent records sit in Consents Manager.
See how Praeferre automates PDPA compliance
Continuous monitoring, evidence and reporting for PDPA — alongside every other framework you need to satisfy.