Singapore Personal Data Protection Act (PDPA)

Why does it matter?

The PDPA is enforced, not advisory: since October 1, 2022 the Commission may impose a financial penalty of up to 10 percent of an organization's annual turnover in Singapore where that turnover exceeds S$10 million, and otherwise up to S$1 million, for an intentional or negligent contravention of the data protection provisions (section 48J). Since February 1, 2021 a notifiable data breach must be reported to the Commission within three calendar days of the organization's assessment, and the Commission publishes its decisions. The Act also defines personal data broadly, as data about an identifiable individual whether true or not, and it reaches foreign organizations that collect, use or disclose personal data in Singapore.

Key benefits include:

• Named obligations with section numbers

Consent (sections 13 to 17), purpose limitation (18), notification (20), access and correction (21 and 22), accuracy (23), protection (24), retention limitation (25), transfer limitation (26) and accountability (11 and 12) give a compliance program a fixed structure.

• A fixed breach clock

Part 6A requires an assessment of a suspected breach, which the PDPC's guide expects within 30 calendar days, and notification to the Commission no later than three calendar days after the breach is assessed to be notifiable (section 26D).

• Two notification thresholds

A breach is notifiable when it is likely to result in significant harm to affected individuals, using the classes of personal data prescribed in the Notification of Data Breaches Regulations 2021, or when it affects 500 or more individuals (section 26B).

• Penalties that scale with turnover

Section 48J ties the maximum financial penalty to annual turnover in Singapore, ascertained from the most recent audited accounts (section 48J(5A)), with directions, undertakings and a right of private action in Part 9C.

• Consent alternatives that must be documented

Deemed consent by notification (section 15A) requires an assessment of adverse effects before use, and the legitimate interests and business improvement exceptions in the First and Second Schedules carry their own conditions.

How does it work?

Part 3 sets the general rules: an organization is responsible for personal data in its possession or control, including data processed for it by a data intermediary (section 4(3)); it must designate one or more individuals responsible for compliance, commonly called the data protection officer, and make their business contact information available (section 11); and it must develop and implement policies and practices, a complaints process and staff communication (section 12). Part 4 governs collection, use and disclosure: consent (section 13), the form of consent (14), deemed consent by conduct, contractual necessity or notification (15 and 15A), withdrawal (16), the exceptions in the First and Second Schedules (17), limitation of purpose (18) and notification of purpose (20).

Part 5 gives individuals a right of access to their personal data and to information about how it has been used or disclosed in the preceding year, and a right of correction (sections 21 and 22), subject to the Fifth and Sixth Schedule exceptions. Part 6 covers care of personal data: reasonable effort to ensure accuracy (section 23), reasonable security arrangements to prevent unauthorized access, collection, use, disclosure, copying, modification or disposal and the loss of storage media (section 24), ceasing retention when the purpose is no longer served and retention is no longer necessary for legal or business purposes (section 25), and no transfer outside Singapore except in accordance with the requirements prescribed under the Act so that the data receives a standard of protection comparable to the Act (section 26).

Part 6A sets the breach regime: a notifiable data breach is one likely to result in significant harm to affected individuals or of a significant scale (section 26B), the organization must assess a suspected breach reasonably and expeditiously (26C), notify the Commission as soon as practicable and no later than three calendar days after the assessment, and notify affected individuals at the same time or after, unless an exception applies (26D); a data intermediary must notify the organization it processes for without delay. Part 9 runs the Do Not Call Register, Part 9B creates offenses for egregious mishandling of personal data (unauthorized disclosure, improper use and unauthorized re-identification of anonymized information, sections 48D to 48F), and Part 9C gives the Commission its enforcement powers, including financial penalties (48J), directions (48I) and voluntary undertakings (48L).

Key Elements

• Accountability (sections 11 and 12)

Designate a data protection officer, publish the officer's business contact information, implement data protection policies and practices, run a complaints process and communicate the policies to staff.

• Consent, purpose and notification (sections 13 to 20)

Collect, use or disclose personal data only with consent, deemed consent or a schedule exception, for purposes a reasonable person would consider appropriate, after notifying those purposes.

• Access and correction (sections 21 and 22)

Respond to access requests with the data and the uses and disclosures made within the past year, and correct errors or omissions, subject to the Fifth and Sixth Schedule exceptions.

• Accuracy, protection and retention (sections 23 to 25)

Make a reasonable effort to keep data accurate and complete, make reasonable security arrangements, and cease retention once the purpose is served and retention is no longer necessary.

• Transfer limitation (section 26)

Transfer personal data outside Singapore only under the prescribed requirements, which include contractual clauses, binding corporate rules and the certifications listed in regulation 12 of the Personal Data Protection Regulations 2021.

• Data breach notification (Part 6A)

Assess suspected breaches, notify the Commission within three calendar days of a notifiable assessment, notify affected individuals, and keep records of the assessment and notifications.

What does it cover?

The Act applies to every organization, meaning any individual, company, association or body of persons, whether or not formed, recognized, resident or having an office in Singapore, that collects, uses or discloses personal data in Singapore (section 2). Section 4 excludes public agencies, individuals acting in a personal or domestic capacity and employees acting in the course of employment, and it limits the obligations of a data intermediary processing under a written contract to the Protection and Retention Limitation Obligations and the breach duties. Business contact information is outside Parts 3 to 6A unless expressly mentioned, records over 100 years old are excluded, and the personal data of a deceased individual is protected for ten years for disclosure and security purposes.

What are its objectives?

Section 3 states the Act's purpose: to govern the collection, use and disclosure of personal data by organizations in a manner that recognizes both the right of individuals to protect their personal data and the need of organizations to collect, use or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances. In practice the Act seeks to:

Give individuals control through consent, notification of purposes, access and correction rights and the Do Not Call Register.

Make organizations accountable through a designated officer, written policies and practices and a complaints process.

Protect personal data in use and at rest through the Protection, Accuracy, Retention Limitation and Transfer Limitation Obligations.

Bring serious breaches to the Commission and affected individuals within fixed timeframes under Part 6A.

Deter mishandling through the Part 9B offenses and the turnover-based financial penalties in section 48J.

Framework in Context

The PDPA is Singapore's general privacy law and sits beside sector rules such as the Monetary Authority of Singapore's requirements for financial institutions and the Cybersecurity Act 2018 for critical information infrastructure owners. Its structure is consent-based with named exceptions rather than the lawful-bases model of the GDPR, its breach threshold of 500 individuals and three-day clock differ from the GDPR's 72 hours, and its transfer rules rely on the Personal Data Protection Regulations 2021, which since March 2, 2026 recognize the APEC Cross-Border Privacy Rules and Privacy Recognition for Processors systems and the Global CBPR and PRP systems for recipients. The PDPC's Advisory Guidelines on Key Concepts in the PDPA (revised April 29, 2026) are the Commission's interpretation of each obligation, and its Guide on Managing and Notifying Data Breaches sets out the assessment and notification steps.

Common Framework Mappings

Organizations map the PDPA's obligations to the frameworks below so that one set of privacy controls and evidence serves the PDPC, overseas regulators and customer assessments.

Mapped frameworks include:

APEC CBPR System

CCPA/CPRA

GDPR

ISO 27001:2022

ISO 27002:2022

ISO 27018

ISO 27701

NIST Privacy Framework v1.0