Singapore PDPA: Data Protection Obligations for IT Companies

The PDPA Singapore, formally the Personal Data Protection Act 2012, is Singapore's main data protection law for the private sector. It applies to any organisation that collects, uses or discloses personal data in Singapore, including foreign companies, and sets a group of data protection obligations alongside the national Do Not Call registry. The 2020 amendments added mandatory breach notification, new consent exceptions and higher penalties.

The PDPA is more flexible than the GDPR in some areas, such as deemed consent and the legitimate interests exception, and stricter in others, such as a three calendar day breach notification deadline. This guide explains the obligations, consent rules, data intermediaries, transfers, breach notification, penalties and the steps SaaS and IT companies should take.

What is the PDPA?

The Personal Data Protection Act 2012 sets a baseline standard for protecting personal data in Singapore. It works alongside sector rules such as banking secrecy and Monetary Authority of Singapore requirements, and does not apply to public agencies, which are covered by separate public sector rules. The Personal Data Protection Commission (PDPC), part of the Infocomm Media Development Authority (IMDA), administers and enforces it and publishes advisory guidelines and decisions.

"Personal data" means data, true or not, about an individual who can be identified from that data or from that data and other information the organisation has or is likely to have access to. Business contact information, provided for business purposes, is excluded from most obligations.

Who must comply?

• Organisations, including companies, associations and individuals acting in a business capacity, whether or not formed or resident in Singapore, that collect, use or disclose personal data in Singapore.
• Data intermediaries, which process personal data on behalf of another organisation under a written contract. They have the protection, retention limitation and breach notification obligations directly, while the engaging organisation keeps the others.

Exclusions include individuals acting in a personal or domestic capacity, employees acting in the course of employment, and public agencies.

Is it mandatory or voluntary?

Mandatory for covered organisations. Certification is voluntary: the Data Protection Trustmark (DPTM) run by IMDA, and the APEC Cross-Border Privacy Rules (CBPR) and Privacy Recognition for Processors (PRP) systems, let organisations show their practices to customers.

The data protection obligations

1. Consent: obtain consent before collecting, using or disclosing personal data, unless deemed consent or an exception applies; allow withdrawal of consent.
2. Purpose limitation: use data only for purposes a reasonable person would consider appropriate and that have been notified.
3. Notification: tell individuals the purposes on or before collection.
4. Access and correction: provide access to personal data and information about its use and disclosure in the past year, and correct errors.
5. Accuracy: make reasonable efforts to ensure data is accurate and complete where it will be used for decisions or disclosed.
6. Protection: make reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal, and loss of storage media.
7. Retention limitation: stop retaining data, or anonymise it, when it is no longer needed for business or legal purposes.
8. Transfer limitation: transfer data outside Singapore only in line with requirements that ensure a comparable standard of protection.
9. Data breach notification: assess and notify notifiable breaches.
10. Accountability: appoint a data protection officer, develop and publish policies and practices, and handle complaints.
11. Data portability: enacted in 2020 but, as of October 2026, not yet brought into force.

Consent, deemed consent and exceptions

Consent must be given after the individual is told the purposes, and cannot be required as a condition of providing a product or service beyond what is reasonable to provide it. The 2020 amendments widened the ways organisations can process data:

• Deemed consent by conduct, where an individual voluntarily provides data for a purpose.
• Deemed consent by contractual necessity, for disclosure to third parties needed to fulfil a contract.
• Deemed consent by notification, where the organisation notifies the purpose, gives a reasonable opt-out period and has assessed that the processing is not likely to have an adverse effect on the individual.
• Legitimate interests exception, where the organisation's legitimate interests outweigh any adverse effect, after an assessment and with disclosure that it relies on this exception.
• Business improvement exception, for using data to improve or develop products, services or operations, or to understand customers, within the corporate group.

Assessments for deemed consent by notification and legitimate interests must be documented and made available to the PDPC on request.

Data protection officer

Every organisation must designate at least one person to be responsible for ensuring PDPA compliance, commonly called the DPO, and make the business contact information of at least one such person publicly available. The role can be outsourced, but the organisation remains responsible. The PDPC encourages registration of DPO details through the business registration system.

Data breach notification

When an organisation has reason to believe a data breach has occurred, it must assess whether the breach is notifiable in a reasonable and expeditious manner, generally within 30 calendar days. A breach is notifiable if it:

• results in, or is likely to result in, significant harm to affected individuals, which the regulations link to prescribed categories of data such as identification numbers, financial information, health information and account credentials; or
• is of a significant scale, meaning it affects 500 or more individuals.

The organisation must notify the PDPC as soon as practicable, and in any case no later than three calendar days after assessing that the breach is notifiable. Where significant harm is likely, it must also notify affected individuals, subject to limited exceptions such as where remedial action makes harm unlikely. Data intermediaries must notify the organisation they act for without undue delay after having reason to believe a breach has occurred.

Transfers outside Singapore

The transfer limitation obligation, detailed in the Personal Data Protection Regulations 2021, requires the transferring organisation to take appropriate steps to ensure the recipient is bound by legally enforceable obligations to provide a comparable standard of protection. Acceptable means include contracts, binding corporate rules, the recipient's law, and specified certifications such as APEC CBPR and PRP. Amendment regulations in force from 2 March 2026 expanded the scope of recognised certifications. Transfers can also proceed with consent after notice, or where necessary for a contract with the individual.

Access requests in practice

When an individual asks for access, the organisation must provide the personal data in its possession or control and information about how it has been or may have been used or disclosed in the year before the request. It must respond as soon as reasonably possible, and if it cannot respond within 30 days, it must tell the individual in writing when it will respond. It may charge a reasonable fee for the incremental cost of access, but must give an estimate first. Some information can be withheld, such as opinion data kept for evaluative purposes, or information that would reveal personal data about another individual. Correction requests must be handled similarly, and corrected data should be sent to organisations it was disclosed to in the past year where needed.

For software products, this means account systems should be able to export a user's data and keep a record of significant disclosures to third parties, such as partners, payment providers or analytics services.

Guidance on AI, children and anonymisation

The PDPC supplements the Act with advisory guidelines. These are not law, but the PDPC uses them when interpreting obligations. Recent guidance includes advisory guidelines on the use of personal data in AI recommendation and decision systems, which explain how the business improvement and research exceptions can apply to model development and what organisations should disclose to users, and advisory guidelines on children's personal data in the digital environment, which expect stronger protections and clearer notices for services likely to be used by children. The PDPC also publishes guides on anonymisation, which matter because properly anonymised data is outside the Act's obligations.

Do Not Call provisions

The PDPA's Do Not Call (DNC) provisions restrict sending marketing messages by voice call, text or fax to Singapore telephone numbers registered on the DNC registry, unless the individual has given clear and unambiguous consent. Organisations must check the registry within a set period before sending, and must not use dictionary attacks or address-harvesting software. Penalties for DNC breaches are separate from the data protection obligations.

Penalties and enforcement

The PDPC can direct organisations to stop collecting or using data, destroy data, comply with directions and pay financial penalties. Since 1 October 2022, the maximum financial penalty is 10 percent of the organisation's annual turnover in Singapore where that turnover exceeds S$10 million, or S$1 million otherwise. The 2020 amendments also created offences for individuals who knowingly or recklessly disclose or misuse personal data or re-identify anonymised data. The PDPC publishes its enforcement decisions, many involving inadequate security, such as weak passwords, unpatched systems and misconfigured cloud storage, and it can accept voluntary undertakings instead of a full investigation.

How to comply, step by step

1. Appoint a DPO and publish contact details.
2. Map personal data, purposes, consent basis or exception, retention and transfers.
3. Write notices and data protection policies, and publish them.
4. Document assessments for deemed consent by notification and legitimate interests.
5. Build access and correction handling, including the record of disclosures for the past year.
6. Implement reasonable security and test it.
7. Set up a breach process with a 30-day assessment and three-day notification.
8. Put transfer contracts or certifications in place.
9. Check DNC rules for marketing.
10. Consider DPTM certification as evidence for customers.

Documentation you will need

• DPO designation and contact details.
• Data inventory and data flow maps.
• Privacy notices and data protection policies.
• Assessments for legitimate interests and deemed consent by notification.
• Access and correction request records.
• Security policies, risk assessments and test results.
• Breach assessments and notifications.
• Transfer contracts and data intermediary agreements.
• Retention schedule and disposal records.

Timeline and cost considerations

A business already compliant with the GDPR can usually align with the PDPA in a few weeks, mainly by adding the DPO details, documenting PDPA exceptions, adjusting breach timelines and checking DNC rules. DPTM certification usually takes a few months including preparation and assessment. Costs are mainly internal effort, legal review and any certification fees.

Common mistakes for SaaS and IT companies

• Weak security basics, the most common cause of PDPC penalties.
• Not documenting legitimate interests assessments.
• Missing the three-day notification window because assessment starts late.
• Data intermediary contracts that do not spell out protection, retention and breach duties.
• Keeping data indefinitely.
• Sending marketing texts without DNC checks.

Best practices, tools and technologies

• Use MFA, encryption, patching and access reviews, which the PDPC repeatedly highlights.
• Run security testing for web applications and APIs before launch.
• Automate retention and anonymisation.
• Log access to personal data and alert on unusual exports.
• Align with ISO/IEC 27001 and ISO/IEC 27701 where certifications help sales.

We build access controls, audit logging and data retention features into web and SaaS platforms through our web application development service.

How the PDPA relates to other laws

Law or framework	Relationship
GDPR	Stricter on legal bases; PDPA offers deemed consent and business improvement exceptions.
Australia Privacy Act	Regional peer with its own breach scheme and principles.
PIPL	China's stricter law with transfer assessments and localisation.
ISO/IEC 27701	Privacy management system that supports accountability.
SOC 2	Common vendor security evidence.

Real-world example

An Indian software company acts as a data intermediary for a Singapore insurer, building and maintaining its customer portal. The contract sets out security requirements, retention periods and a 24-hour breach notice. The company restricts production access, masks data in test environments, and keeps logs. When a misconfigured test server exposes a small set of records, it informs the insurer the same day, the insurer assesses the breach within days, finds fewer than 500 people affected but identification numbers involved, and notifies the PDPC and the individuals within three calendar days.

Next steps

1. Appoint and publish a DPO.
2. Map data and document consent or exceptions.
3. Strengthen security basics.
4. Set up breach assessment and notification.
5. Review transfers and intermediary contracts.

Frequently asked questions

Does the PDPA apply to foreign companies?

Yes, if they collect, use or disclose personal data in Singapore.

Is a DPO mandatory under the PDPA?

Yes. Every organisation must designate at least one person responsible for compliance and publish their business contact information.

When must a data breach be notified?

Within three calendar days after assessing it as notifiable, which applies if significant harm is likely or 500 or more individuals are affected.

What is the maximum penalty?

Up to 10 percent of annual Singapore turnover for organisations with turnover above S$10 million, or S$1 million otherwise.

What is a data intermediary?

An organisation processing personal data on behalf of another under a written contract; it has protection, retention and breach notification duties.

Does the PDPA allow legitimate interests?

Yes, as an exception to consent, after an assessment and disclosure.

Can personal data be transferred outside Singapore?

Yes, if the recipient is bound to a comparable standard of protection through contracts, binding corporate rules, law or recognised certifications.

Is data portability in force?

No. It was enacted in 2020 but had not been brought into force as of October 2026.

What is the DPTM?

The Data Protection Trustmark, a voluntary IMDA certification showing that an organisation has sound data protection practices.

Does the PDPA cover business contact information?

Business contact information provided for business purposes is excluded from most obligations.

Does the PDPA apply to the public sector?

No. Public agencies are covered by separate public sector data protection rules.