Guide · Compliance
PDPA Singapore: Personal Data Protection Act Guide
PDPA Singapore is short for the Personal Data Protection Act 2012, the law that sets the baseline for how organisations collect, use, share and look after personal data in Singapore. This guide covers what counts as personal data, the 11 obligations, the breach rules, the penalties and a simple check for any marketing lead form.
What the PDPA is
The PDPA gives a baseline standard of protection for personal data in Singapore. It sits alongside sector rules, such as the Banking Act and the Insurance Act, rather than replacing them. It covers data held on paper as well as in electronic form.
The Act also set up the national Do Not Call (DNC) Registry. People can list their Singapore phone numbers there to opt out of telemarketing calls, texts and faxes. Our DNC Registry Singapore guide covers those rules.
The Personal Data Protection Commission (PDPC) runs the Act. It aims to protect people's data while still letting organisations use it for fair and reasonable purposes.
Sources: PDPC, PDPA Overview
Key dates
Year What happened 2012 The Personal Data Protection Act is passed 2 January 2013 The PDPC is set up 2 January 2014 DNC Registry rules come into force 2 July 2014 Main data protection rules come into force 2 November 2020 Amendments to the PDPA are passed 1 February 2021 Amendments start to take effect in phases, including mandatory breach notice 1 October 2022 Higher maximum financial penalty starts Sources: PDPC, PDPA Overview; PDPC, Amendments to regulations and advisory guidelines; Singapore Statutes Online, PDPA 2012 section 48J
What counts as personal data
Personal data is data about a person who can be identified from it. It also covers data that identifies someone when joined with other information the organisation has, or is likely to have.
So a lead list from a website form, with names and mobile numbers, is personal data. So is a spreadsheet of past buyers with their personal emails.
The Act mostly does not apply to:
- A person acting in a personal or household capacity.
- An employee acting for their employer.
- Public agencies collecting, using or sharing personal data.
- Business contact details, such as a person's job title, work phone, work address and work email.
That last point matters for B2B marketing. A work email given out for business is treated differently from a home email. Ask a lawyer if a list mixes the two.
Sources: PDPC, PDPA Overview
The 11 obligations
PDPC lists 11 obligations for organisations. Here they are in plain words.
Obligation What it asks you to do 1. Accountability Have data protection policies, share them on request, and name a data protection officer (DPO) whose business contact details are public 2. Notification Tell people why you are collecting, using or sharing their data 3. Consent Use data only for purposes the person agreed to, and let them withdraw consent with reasonable notice 4. Purpose limitation Use data only for purposes a reasonable person would see as fair, and do not force extra consent as a condition of service 5. Accuracy Make a reasonable effort to keep data correct and complete 6. Protection Put reasonable security in place against unauthorised access or use 7. Retention limitation Delete or dispose of data once there is no business or legal need for it 8. Transfer limitation Only send data overseas where protection is comparable to the PDPA 9. Access and correction On request, show people their data and how it was used in the past year, and fix errors 10. Data breach notification Assess breaches and notify PDPC and affected people when required 11. Data portability Move a person's data to another organisation on request, in a machine-readable format PDPC marks the data portability obligation as taking effect only when its regulations are issued. Exceptions apply to several obligations. PDPC's advisory guidelines explain them.
Sources: PDPC, Data Protection Obligations
Data breaches: when you must tell PDPC
Since the 2021 amendments, some breaches must be reported. A breach is notifiable if it causes, or is likely to cause, significant harm to people, or if it is of a significant scale.
The Act says a breach is of significant scale if it affects at least a "prescribed number" of people. Compliance guides that cite the 2021 breach regulations put that number at 500.
Once you decide a breach is notifiable, you must tell PDPC as soon as you can. The Act sets an outer limit: no later than 3 calendar days after you made that assessment. You must usually tell the affected people too.
A breach that stays inside one organisation, with no one outside seeing the data, is treated differently under the Act. Check the exact wording before relying on it.
Sources: Singapore Statutes Online, PDPA 2012 section 26B; Singapore Statutes Online, PDPA 2012 section 26D; Security Quotient, Singapore PDPA guide
Penalties
PDPC can order an organisation to pay a financial penalty if it broke the data protection rules on purpose or through negligence. Since 1 October 2022, the ceiling depends on size:
Organisation Maximum financial penalty Yearly turnover in Singapore above S$10 million 10% of that yearly Singapore turnover All other cases S$1 million The DNC rules have their own ceilings. For an individual it is S$200,000. For others it is S$1 million.
The money is not the only cost. Under section 48I, PDPC can also give directions to put things right. PDPC also publishes its enforcement decisions, so a case stays on the public record.
Sources: Singapore Statutes Online, PDPA 2012 section 48J; PDPC, Amendments to regulations and advisory guidelines
A PDPA check for any marketing lead form
Most guides list the obligations and stop. This table turns six of them into checks you can run on one web form today, such as a "request a quote" page your agency built.
Check on the form Obligation it serves Pass if Says why you collect each field Notification The purpose is written next to the form, not only in a long policy Asks only for what you need Purpose limitation No NRIC, birth date or home address unless the service truly needs it Marketing consent is a separate, unticked box Consent Saying no to marketing still lets the person send the form Shows how to opt out later Consent An email or link to withdraw consent is on the page or in every message Names who to contact Accountability The DPO's business contact details are easy to find Sends data to a known place Protection, transfer limitation You know which tool stores the leads and in which country If your agency runs the form, ask them to show you each row. This fits into the evidence checks in our guide on how to brief an agency. It also connects to the editors' public methodology, which reads for reporting integrity.
This table is a starting point, not legal advice. For your own case, speak to a lawyer or read PDPC's advisory guidelines.
Sources: PDPC, Data Protection Obligations
Frequently asked questions
What is the PDPA in Singapore?
The PDPA is the Personal Data Protection Act 2012. It sets baseline rules for how organisations collect, use, share and protect personal data in Singapore, and it set up the Do Not Call Registry.
What are the PDPA requirements?
PDPC lists 11 obligations: accountability, notification, consent, purpose limitation, accuracy, protection, retention limitation, transfer limitation, access and correction, data breach notification and data portability.
What is the penalty for breaking the PDPA?
Since 1 October 2022, up to 10% of yearly Singapore turnover for organisations with more than S$10 million turnover there, or up to S$1 million in any other case.
What are 5 examples of personal data?
Any data that can identify a person, alone or with other data the organisation holds. In marketing, typical cases are a name with a mobile number, a personal email, a home address, a photo of a face and a customer record tied to a person. Business contact details used for work are mostly outside the Act.
How fast must a data breach be reported in Singapore?
As soon as practicable, and no later than 3 calendar days after the organisation assesses that the breach is notifiable.
Does every business need a data protection officer?
Yes, under the accountability obligation an organisation must designate a DPO and make that person's business contact information available to the public.
Sources