Meet Singapore PDPA obligations with evidence you can show

The PDPA is the Personal Data Protection Act 2012, Singapore's general data protection law for the private sector. It sets rules on how organisations collect, use, disclose, protect, retain and transfer personal data, gives individuals rights to access and correct their data, and requires notification of serious data breaches. It also establishes the Do Not Call Registry for marketing messages sent to Singapore telephone numbers. The Personal Data Protection Commission (PDPC) administers and enforces the Act.

Any organisation that collects, uses or discloses personal data in Singapore must comply with the PDPA, including organisations with no office or place of business in Singapore. Data intermediaries processing personal data on behalf of another organisation under a written contract must still meet the protection, retention and breach notification duties. Public agencies, and individuals acting in a personal or domestic capacity, are excluded from the data protection obligations.

The PDPC groups the PDPA into ten data protection obligations: accountability, notification, consent, purpose limitation, accuracy, protection, retention limitation, transfer limitation, access and correction, and data breach notification. A data portability obligation has also been passed into law but is not yet in force. Accountability includes designating at least one person, often called a data protection officer, and making their business contact information publicly available.

The PDPC can impose a financial penalty of up to S$1 million, or up to 10% of annual turnover in Singapore for organisations whose Singapore turnover exceeds S$10 million, whichever applies. The higher cap took effect on 1 October 2022. The PDPC can also issue directions to stop collecting data or destroy it, and individuals who suffer loss can bring a private action. Some conduct, such as reckless unauthorised disclosure by individuals, is a criminal offence.

A data breach must be reported to the PDPC no later than 3 calendar days after an organisation assesses it as notifiable. A breach is notifiable if it causes, or is likely to cause, significant harm to affected individuals, or affects 500 or more individuals. Organisations must assess a suspected breach expeditiously, and where significant harm is likely they must also notify the affected individuals, subject to limited exceptions.

The PDPA and GDPR share core ideas such as purpose limitation, security, access rights and breach notification, but they are not interchangeable. The PDPA relies mainly on consent and deemed consent with defined exceptions, and has no direct equivalent of GDPR's lawful bases. Its breach notification window and penalty caps also differ. GDPR compliance work gives a strong head start, but Singapore-specific obligations such as the Do Not Call rules still need separate attention.

Yes, ISO 27001 helps mainly with the PDPA Protection Obligation, which requires reasonable security arrangements to prevent unauthorised access, use, disclosure and similar risks. An ISO 27001 information security management system gives documented, tested security controls and evidence. It does not cover consent, notification, access and correction, retention or Do Not Call obligations, so those still need their own privacy policies and processes.

Yes. OneClickComply supports the Singapore PDPA today. Controls you already operate for frameworks such as ISO 27001 or GDPR can be reused against PDPA obligations, with automated evidence collection, policy generation and vendor risk management. OneClickComply does not certify PDPA compliance, as the PDPA has no certification scheme, but our auditors can advise on gaps.