PDPA (SG)

Singapore's Personal Data Protection Act (PDPA) governs how private-sector organizations collect, use and disclose personal data. It is consent-based but practical: it recognizes deemed consent and a legitimate interests exception, it requires a data protection officer, and since February 2021 it requires notification of significant data breaches.

It also houses Singapore's Do Not Call Registry rules for marketing messages to Singapore numbers.

• Organizations collecting, using or disclosing personal data in Singapore, including those outside Singapore.
• Public agencies are excluded; organizations acting on their behalf have limited duties.
• Data intermediaries processing data for another organization have protection, retention and breach notification duties.

Individuals can withdraw consent with reasonable notice, access their personal data and information about how it was used or disclosed in the past year, and ask for corrections.

Financial penalties of up to 10% of the organization's annual turnover in Singapore where that turnover exceeds S$10 million, or up to S$1 million otherwise. The Personal Data Protection Commission publishes its enforcement decisions, which frequently concern the protection obligation.

1. Appoint a data protection officer and publish their business contact information.
2. Check your consent basis for each purpose, including deemed consent and legitimate interests assessments.
3. Tighten protection: most enforcement cases involve inadequate security arrangements.
4. Set a breach process: assess within 30 days and notify the Commission within three calendar days of determining a breach is notifiable.
5. Check marketing to Singapore numbers against the Do Not Call Registry.