Eleven obligations, a breach clock that starts when you decide, and a Do Not Call regime that fails separately from all of it. This page is what the Act asks for, and what the proof looks like.
Broader than “companies registered in Singapore”. The Act follows the data and the activity, not the incorporation certificate.
The Personal Data Protection Act 2012, administered by the PDPC — the Personal Data Protection Commission, part of IMDA. Data protection provisions in force from July 2014; Do Not Call from January 2014. It reaches organisations regardless of whether they are formed or resident in Singapore.
Consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation, breach notification, accountability and data portability. Accountability is the one that turns the rest into documents — policies, practices, a DPO, and the ability to demonstrate all three.
At least one Data Protection Officer, with business contact details made publicly available. It can be an existing employee and it can be a shared role. What it cannot be is unnamed, or unfindable from the outside.
Five situations, ordered by how often the reader gets them wrong. The last two are the ones that catch people.
Four changes, and each one is something you would not have built a process for.
Assess expeditiously. Notify the PDPC within three calendar days of determining a breach is notifiable. Tell affected individuals as soon as practicable where the harm is significant.
Legitimate interests, and business improvement. Consent stopped being the only door — which means “we got consent” is now sometimes the wrong answer rather than the safe one.
Unauthorised disclosure, improper use, and unauthorised re-identification of anonymised data — reaching individuals, not only organisations.
The financial penalty cap rose materially, and data portability was enacted. Both sit on this page’s verification queue rather than being asserted as settled.
Two of these are on this page’s verification queue. The penalty figures and the criminal-offence provisions are the least certain numbers here, and the in-force position of data portability is an open question rather than a settled one. Where this page is not sure, it says so instead of rounding to confident.
The PDPC’s own framing of what the Act requires. Grouped by when they bite: before the data arrives, while you hold it, and when something happens.
Collected, used or disclosed with consent, or under an exception
Only for purposes a reasonable person would consider appropriate
Tell people the purpose before or at the time of collection
People can ask what you hold and have it corrected
Reasonable effort to keep data accurate and complete
Reasonable security arrangements
Cease retention when the purpose is served
Overseas transfers to a comparable standard of protection
Notify the PDPC, and individuals where harm is significant
Policies, practices, a DPO, and the ability to show all three
Transmit data to another organisation on request
Data portability is marked, and the mark is deliberate. It was enacted by the 2020 Amendment Act; whether it is in force is the thing to confirm before you rely on it either way. Rendering it exactly like the other ten would imply a certainty this page does not have. It is worth designing for regardless — the engineering is the long pole, not the drafting.
Which is why the assessment is the real deadline. The clock to the PDPC runs from the moment you determine a breach is notifiable — so nearly all of the pressure sits in the window before that.
Conducted expeditiously — and this step carries no fixed number, which is the trap.
You must be able to show That the procedure existed before the incident, and when the assessment started.
Likely to result in significant harm to affected individuals — or of significant scale.
You must be able to show The reasoning, either way. A “not notifiable” call is a decision you have to be able to defend later.
Within three calendar days of determining it is notifiable.
You must be able to show The determination date, and what was sent.
As soon as practicable, where the harm is significant.
You must be able to show Who was told, when and how — and why not, where you did not.
The branch most people miss. Significant scale takes you to the PDPC. Significant harm is what takes you to the individuals. They are not the same test and they do not always fire together — a large breach of low-sensitivity data and a small breach of highly sensitive data go to different places.
This is the shape of the decision, not the decision. It computes nothing, stores nothing and sends nothing. The thresholds are exactly where judgement lives, and this page is guidance on how we scope a readiness review — not legal advice, and not something to run a live incident from. If you are in one now, call your counsel, not a web page.
A separate regime under the same Act, with its own contraventions. Four things that catch organisations out.
No Voice Call, No Text Message and No Fax Message are distinct. A check against one is not a check against another.
Register results are valid for a limited window — thirty days at the time of writing. A stale check is the same as no check.
Ongoing-relationship and business-to-business exemptions exist and are narrower than most marketing teams assume. Claim one, and you have to be able to evidence it.
DNC breaches are their own contravention. A flawless data protection programme does not protect you from one, which is why this sits in the same engagement.
Voluntary guidance for responsible AI deployment. Neither of these replaces the PDPA — if your AI touches personal data, the eleven obligations apply in full regardless of how well you align to either.
IMDA and the PDPC's framework for deploying AI responsibly — internal governance, human involvement in decision-making, operations management, and stakeholder communication. A generative-AI edition followed. Voluntary, and widely used as the structure Singapore regulators recognise.
An AI governance testing framework and software toolkit, developed by IMDA and now stewarded by the AI Verify Foundation. It does not certify a system; it produces a standardised report of technical tests and process checks against the Model Framework's principles.
The shape is familiar — consent, purpose, access, retention, transfer, breach. These four are where the familiarity costs you.
A basis from the Article 6 list.
Consent — including deemed consent by conduct or by contractual necessity — or an exception, now including legitimate interests and business improvement.
72 hours from awareness.
Assess expeditiously, then three calendar days from determining it is notifiable — on significant harm or significant scale.
Article 37, conditional. Plenty of teams correctly concluded they did not need one.
At least one, always — with business contact details made publicly available.
No analogue inside the same statute.
The Do Not Call regime — a separate contravention under the same Act.
A clean GDPR programme is a strong head start on eight of the eleven. It is not a head start on these four — and the DPO row is the one that surprises people most, because it is the one where GDPR let them off.
Three routes, and they are not alternatives — a single incident can attract a financial penalty, a direction, and in the worst cases a prosecution of the individuals involved.
Up to 10% of annual turnover in Singapore, or S$1 million, whichever is higher — the higher cap introduced by the 2020 Amendment Act.
The 2020 Amendment created offences for unauthorised disclosure, improper use and unauthorised re-identification of anonymised data, reaching individuals as well as organisations.
The PDPC can direct an organisation to stop collecting, to destroy data, or to remediate. Directions and undertakings are common outcomes alongside — or instead of — a penalty.
Structured around the obligations themselves, so the report reads in the PDPC’s own vocabulary rather than in ours — and all eleven are in scope, not a selection.
| Obligation area | What the assessment does |
|---|---|
| Consent and notification | Every collection point reviewed against what is actually said to the individual, and against the exception you are relying on if consent is not the basis. |
| Purpose and retention | Purposes mapped per data set, with a retention schedule that names owners and a disposal step someone actually performs. |
| Protection | Security arrangements tested rather than attested, including the processors and vendors that hold the data on your behalf. |
| Transfer limitation | Where the data physically goes, under what contractual protection, and whether that matches what your notice says. |
| Breach notification | The assessment procedure, the three-day clock, and a rehearsal — most of the window is spent deciding whether it is notifiable. |
| Accountability | DPO appointment and visibility, policies, training records, and the complaint route from the outside in. |
| Do Not Call | Register checking, the thirty-day validity window, and whether your exemption claims survive inspection. |
| AI on personal data | PDPA obligations read against the model as deployed, and mapped to the Model AI Governance Framework where you want to show alignment. |
What personal data you hold, where it came from, which purpose it serves, who it is disclosed to and where it goes overseas. Almost every other obligation is answered from this one document.
Addresses: Purpose limitation, Transfer limitation
Consent captured with what was shown at the time, withdrawal honoured downstream, and where you rely on legitimate interests or business improvement, the assessment recorded rather than assumed.
Addresses: Consent obligation, Notification obligation
A written assessment procedure against the significant-harm and significant-scale thresholds, and a rehearsal against the clock — because the expensive part is deciding, not reporting.
Addresses: Breach notification, Protection obligation
A request route a member of the public can find without help, an identity check that is proportionate, and a response record that shows the clock was met.
Addresses: Access and correction, Accuracy obligation
Ceasing retention is an action, not a policy. Schedules with owners, disposal that reaches backups and archives, and evidence that it happened.
Addresses: Retention limitation, Protection obligation
Where data actually lands, the contractual protection covering it, and whether the receiving jurisdiction gives a comparable standard — checked against your own notice.
Addresses: Transfer limitation, Accountability obligation
Every activity is recorded with a timestamp, a named owner and the method used. Under a regime where self-reporting and demonstrable programmes are consistently treated as mitigating, that trail is worth more than the documents on their own.
Every finding lands on one of the eleven obligations, so the report reads in the PDPC's own structure.
The breach clock rehearsed against your own escalation path, not against a generic template.
Register checking and exemption claims reviewed in the same engagement, because they fail separately from the data obligations.
Findings tagged to the Model AI Governance Framework where you want to evidence alignment alongside the statute.
A practical path to PDPA compliance with clear milestones. The weeks are elapsed position, not effort — the phases overlap in practice.
Find out what you actually hold
Write down what you will actually do
Make the obligations something people do
Evidence that it keeps working
29 ready-to-use templates covering the eleven obligations, breach handling, the Do Not Call regime and AI on personal data.
+ 4 more policies
+ 3 more policies
+ 4 more policies
What comes up in every PDPA scoping call. Filter to the one you came for.
Very likely, if you collect, use or disclose the personal data of people in Singapore. The Act is written around the activity rather than around where the organisation is incorporated, and overseas services with Singapore users are routinely in scope.
Mandatory data breach notification, new exceptions to consent including legitimate interests and business improvement, offences for egregious mishandling of personal data, provisions on data portability, and a substantially higher financial penalty cap.
Yes — at least one, and their business contact information has to be made publicly available. It can be an existing employee and it can be a shared role; what it cannot be is unnamed or unfindable from the outside.
A data intermediary processes personal data on another organisation's behalf under a written contract. That narrows its own obligations to protection and retention, but the organisation instructing it remains answerable for the rest — and for choosing it.
When the breach results in, or is likely to result in, significant harm to affected individuals, or is of significant scale. The assessment has to be conducted expeditiously, and once you determine it is notifiable the PDPC must be told within three calendar days. Affected individuals are told as soon as practicable where the harm is significant.
Within a reasonable time, with the PDPC's guidance setting an expectation measured in weeks rather than months, and an obligation to tell the individual if you cannot meet it. The practical constraint is almost always locating the data, which is a reason to keep the inventory current.
In defined circumstances, yes — and the exceptions are narrower than they look. Refusing is a decision you have to be able to explain later, so it is worth recording the reasoning at the time rather than reconstructing it.
Prompt notification and cooperation are consistently treated as mitigating. The pattern in published decisions is that organisations which found the problem, told the PDPC and had remediation underway fare materially better than those which did not.
No. It is voluntary guidance from IMDA and the PDPC, and so is AI Verify. Neither replaces the PDPA — if your AI touches personal data, the eleven obligations apply in full regardless of how well you align to the Model Framework.
A testing framework and software toolkit that runs technical tests and process checks against the Model Framework's principles and produces a standardised report. It is not a certification and it does not assert that a system is fair or safe — it documents what was tested and what came out.
Check the relevant register before sending a specified message to a Singapore number, keep the result inside its validity window, and treat the three registers as separate. Ongoing-relationship and business-to-business exemptions exist, are narrow, and have to be evidenced if relied on.
The shape is familiar — consent, purpose, access, retention, transfer, breach — but the details differ enough that a GDPR programme does not transfer unchanged. Consent exceptions, the notification thresholds and the DNC regime are the three places teams most often assume equivalence and are wrong.
Typically four to eight weeks depending on how much of the personal data inventory already exists. Where it does not, building it is the work — everything else is derived from it. Scope is agreed with you before anything is charged.
This page is a working summary. Where a decision turns on the wording, the Act and the PDPC’s guidance are public and free.
The regulator and the framework body. External links.
The regimes that most often sit alongside the PDPA in one scope.
Inventory first, then the eleven obligations, then the breach drill and the DNC path. Scoped with you before you are charged.
This page is guidance on how we scope a PDPA readiness review, not legal advice. Singapore counsel should confirm anything you intend to rely on.
From Insights
Six things to have ready before the engagement starts. Assembling them takes a fortnight off the clock — and tends to find the first two findings before an auditor does.
Read the notesAn independent review of what your AI actually does, measured against a named standard — not a certificate, and not a review of what the documentation says it does.
Read the notesFive working parts, not a policy document. What each one has to do, how to tell whether yours is real, and why a framework is not the same thing as compliance.
Read the guide
