Singapore PDPA

Who it applies to

Private-sector organisations that collect, use or disclose personal data in Singapore. Public agencies are covered by separate rules.

Key requirements

• Consent, purpose limitation and notification obligations.
• Access and correction obligations.
• Protection obligation: reasonable security arrangements.
• Retention limitation and transfer limitation obligations.
• Accountability, including a Data Protection Officer.
• Do Not Call registry rules for marketing messages.

Breach and incident notification

A notifiable breach (significant harm or significant scale) is reported to the PDPC within 3 calendar days of the organisation assessing that it is notifiable, and affected individuals are notified where there is significant harm. The assessment itself should be done within 30 days.

Penalties

Financial penalties of up to 10% of annual turnover in Singapore for organisations whose turnover there exceeds SGD 10 million, or up to SGD 1 million otherwise.

Go deeper