Summary
Awards
Quick answer: Your PDPA obligations are the duties the Personal Data Protection Act 2012 places on any organisation that collects, uses or discloses personal data in Singapore. The PDPC lists 11 of them. Ten apply today; the eleventh, data portability, takes effect only when its regulations are issued.
A customer asks what data you hold on her. Your payroll vendor reports that its server was compromised. These are the moments when the PDPA stops being abstract. This guide walks through each obligation as the Personal Data Protection Commission (PDPC) lists it, with what a business of your size should actually do.
What Is the PDPA, and Does It Apply to Your Business?
The PDPA is Singapore's general data protection law. It applies to almost every private-sector business that collects, uses or discloses personal data in Singapore, whatever its size or place of incorporation. There is no turnover or headcount threshold. The main exclusions are public agencies, individuals acting in a personal capacity, and employees acting in their work.
What counts as personal data under the PDPA
The Act defines personal data as data, whether true or not, about an individual who can be identified from that data, or from that data together with other information you have or are likely to have access to. That covers NRIC numbers, mobile numbers, home addresses, CCTV footage, payroll and medical records, and your sales team's notes on a prospect, for staff as much as customers, whether held in a spreadsheet, a messaging app or a filing cabinet.
One carve-out: business contact information (a name, job title, business phone number or email given for business purposes) falls outside the data protection obligations.
Who carries the obligations
The obligations sit with the organisation, so the company answers for what its staff do with personal data. A payroll provider, cloud host or IT vendor processing data for you is a data intermediary. Under a written contract it carries only the protection, retention and breach notification duties; your business remains responsible for the rest. That is why the data terms in your outsourcing contracts deserve more than a glance.
The 11 PDPA Obligations, One by One
The PDPC groups your PDPA obligations under 11 headings, from accountability to data portability. Most are common sense written into law: tell people why you want their data, use it only for that, keep it safe, and dispose of it when done. The detail lies in what you must be able to show.
1. Accountability Obligation
You must be able to show that you comply: written data protection policies, a complaints process, and at least one designated Data Protection Officer (DPO) whose business contact details are public. What to do: name a DPO, publish a contact email, and write down how you handle personal data.
2. Notification Obligation
Tell individuals why you are collecting, using or disclosing their personal data, for example through a privacy notice on your website or a line on your enquiry form. What to do: check that every collection point (forms, WhatsApp enquiries, CCTV, recruitment) states its purposes.
3. Consent Obligation
Use personal data only for purposes the individual has consented to, unless consent is deemed or an exception applies. Individuals may withdraw consent on reasonable notice, and you must then stop. What to do: make sure an unsubscribe reaches every system that holds the data.
4. Purpose Limitation Obligation
Use personal data only for purposes a reasonable person would consider appropriate, and do not make consent to more than is reasonable a condition of your service. What to do: cut broad "we may share your data with partners" wording.
5. Accuracy Obligation
Make a reasonable effort to keep personal data accurate and complete, especially before you make a decision about the person or disclose it to another organisation. What to do: check data at the point it matters, such as before a credit decision.
6. Protection Obligation
Make reasonable security arrangements against unauthorised access, use, disclosure and similar risks. What to do: limit access by role, use multi-factor sign-in, encrypt portable devices and remove leavers' access on their last day.
7. Retention Limitation Obligation
Dispose of personal data properly once it no longer serves a business or legal purpose. The PDPA prescribes no fixed retention period, so you set one you can justify. What to do: adopt a retention schedule and delete on schedule.
8. Transfer Limitation Obligation
Send personal data overseas only in line with the prescribed requirements, so it receives protection comparable to the PDPA. What to do: find out where your cloud services store data, and put protective terms in place with overseas recipients.
9. Access and Correction Obligation
On request, give individuals their personal data and how it was used or disclosed in the past year, and correct errors. Respond as soon as reasonably possible; if you cannot within 30 days, tell the person in writing, within that time, when you will. What to do: log every request.
10. Data Breach Notification Obligation
Assess whether a breach is notifiable and, if so, notify the PDPC and, where required, the affected individuals (thresholds below). What to do: have a short breach response plan ready.
11. Data Portability Obligation
This will require you to transmit an individual's data to another organisation at their request, in a machine-readable format. It is not yet in force: the PDPC states it will take effect when the regulations are issued.
PDPA obligations at a glance
PDPA Consent: When You Need It and When It Is Deemed
You need consent to collect, use or disclose personal data unless the Act deems consent or an exception applies. Deemed consent covers much of everyday business, such as a customer handing over an address for delivery. Marketing needs the most care, because the PDPC generally expects express consent for it.
Sections 15 and 15A of the PDPA provide three forms of deemed consent: by conduct, where a person volunteers data for an obvious purpose; by contractual necessity, where passing data to another organisation, such as a courier, is reasonably necessary to complete the transaction; and by notification, where you notify a new purpose, allow a reasonable opt-out period, and have first assessed that the use is unlikely to harm the individual.
The Act also sets out exceptions, such as recovering a debt, business improvement and a general legitimate interests exception. That last one is not a blank cheque: you must assess and mitigate any adverse effect, be satisfied your interests outweigh what remains, and disclose that you rely on it. Neither deemed consent by notification nor legitimate interests can be used for direct marketing, which generally needs express consent.
The Do Not Call rules, briefly
The Do Not Call provisions of the PDPA govern marketing calls, texts and faxes to Singapore numbers. Before sending such a "specified message", check the number against the Do Not Call Registry within the 21 days before sending, unless you have valid consent. Messages relating solely to an ongoing relationship, such as account statements, are not specified messages.
What to Do After a PDPA Breach: The 30-Day and 3-Day Clocks
Once you have credible grounds to believe a breach has occurred, you must promptly assess, within 30 calendar days, whether it is notifiable. If it is, notify the PDPC as soon as practicable and no later than three calendar days after that determination. Affected individuals, where required, are told at the same time or after.
When a breach is notifiable
- Significant harm: the breach is likely to cause significant harm to individuals, which the Personal Data Protection (Notification of Data Breaches) Regulations 2021 deem to be so where prescribed classes of data are involved. Notify the PDPC and the affected individuals.
- Significant scale: the breach involves the personal data of 500 or more individuals. Notify the PDPC even if no prescribed data is involved; if the count is unclear, notify once you have reason to believe it is at least 500.
How the deadlines work in practice
The three days start the day after you decide the breach is notifiable: decide on 1 January, and the PDPC must be notified by 4 January. Document every step of your assessment, because unreasonable delay is itself a breach. If the breach happened at a vendor, the vendor must notify you, but the assessment and notification remain your duty.
In the first hours, contain the breach, preserve logs and keep a written timeline. Take advice before anything goes to customers: the first notice is hard to walk back.
PDPA Fines and Penalties: How Exposed Is Your Business?
For a breach of the data protection obligations, the PDPC can impose a financial penalty of up to S$1 million or, where your annual turnover in Singapore exceeds S$10 million, up to 10% of that turnover, whichever is higher. These caps have applied since 1 October 2022. A financial penalty is the most visible outcome, but not the only one.
The PDPC first considers whether directions without a penalty will remedy the breach. Other outcomes include warnings, voluntary undertakings and an expedited procedure where the organisation admits liability. Decisions and undertakings are published on the PDPC's website. Part 9B of the Act also makes it an offence for individuals to knowingly or recklessly disclose personal data without authority, use it for wrongful gain or to cause wrongful loss, or re-identify anonymised data.
For an SME, the penalty is rarely the whole cost: there is also lost customer trust and management time diverted from the business.
What PDPA compliance looks like for a business your size
PDPA requirements for an SME come down to a handful of documents and habits, not a large programme:
- A named DPO with a published business contact.
- A notice stating purposes at each point where you collect personal data.
- Access controls and a leaver checklist for staff and vendors.
- A retention schedule that is actually followed.
- Vendor contracts that cover data protection and breach reporting.
- A one-page breach response plan with the 30-day and 3-day deadlines.
If you want these checked against how your business runs, that sits within our data protection and regulatory compliance work.
This article is general information about the PDPA, not legal advice on your situation.
Knowing Where Your Business Stands on Data Protection
The PDPA does not expect an SME to run a compliance department. It expects you to know what personal data you hold, why you hold it, who can see it, and what you will do when something goes wrong. If you can answer those four questions in writing, the remaining obligations become manageable rather than daunting.
At Triangle Legal LLC, we advise SME founders and directors on data protection as part of their wider commercial and regulatory position, with scope and fees agreed clearly at each stage. You can see who would handle your matter on our team page.
If you have had a data incident, or a customer, employee or the PDPC is asking questions about how you handle personal data, the 30-day assessment clock may already be running. In a complimentary 10-minute case assessment, we can identify which obligations are engaged and what needs to happen first.
PDPA Obligations: Frequently Asked Questions
Q1: Do PDPA obligations apply to a small business?
A: Yes. The PDPA has no size or turnover threshold, so it applies to any organisation that collects, uses or discloses personal data in Singapore unless it falls in an excluded category, such as a public agency. What counts as reasonable, for example in security arrangements, depends on the volume and sensitivity of the data you hold.
Q2: Is it compulsory to appoint a Data Protection Officer?
A: Yes. Section 11(3) of the PDPA requires every organisation to designate one or more individuals to be responsible for ensuring it complies with the Act, and the business contact information of at least one of them must be made available. Designating a DPO does not transfer the company's legal responsibility to that person.
Q3: Do I have to report every data breach to the PDPC?
A: No. You must assess every suspected breach, but you only notify the PDPC if it is likely to cause significant harm to the individuals or involves the personal data of 500 or more people. Keep a written record of your assessment either way, because the PDPC may ask for it.
Q4: Does the PDPA cover employee personal data?
A: Yes. Payroll records, medical certificates and performance reviews are all personal data. When you recruit, manage or end an employment relationship, you must tell the employee the purposes for which their data is collected, used or disclosed, and obligations such as protection and retention still apply.
Q5: What is the maximum PDPA penalty?
A: The cap is S$1 million, or 10% of annual turnover in Singapore where that turnover exceeds S$10 million, whichever is higher. Turnover is taken from the organisation's most recent audited accounts available when the penalty is imposed. The PDPC sets the actual amount according to the facts of each case.
Contact Triangle Legal LLC for a Confidential Discussion Today.
Phone: +65 9247 3935
Email: contact@trianglelegal.com.sg
Website: www.trianglelegal.com.sg
Author Bio: Nico Lee
Nico Lee is the Founder and Managing Director of Triangle Legal LLC, a partner-led Singapore law firm recognised in Asian Legal Business "Firms to Watch 2026". He advises SME founders, directors and creditors on disputes, debt recovery and corporate matters.
