Singapore: PDPA and Related Regulation
The PDPA 2012, substantially amended in 2020, applies to organizations processing personal data in Singapore. It excludes individuals acting in a personal capacity and, largely, public agencies. There is no separate sensitive-data category, but NRIC and financial data attract advisory guidance.
Core obligations
Consent (including deemed consent by contractual necessity, deemed consent by notification, and legitimate-interests exceptions), purpose limitation, notification, access and correction, accuracy, protection, retention limitation, and transfer limitation. Organizations must appoint a DPO and publicly list the DPO's contact. Breach notification: assess within 30 days; notify the PDPC within 3 days of assessment where significant harm or at least 500 individuals are affected, and notify affected individuals. The Do Not Call Registry governs marketing messages to Singapore telephone numbers.
Cross-border
Transfer limitation requires a comparable standard of protection, typically by contract, binding corporate rules, or APEC CBPR certification. Consent is not the only route.
Worked example
A Singapore retailer sends marketing SMS without checking the DNC Registry and exports loyalty data to a Malaysian vendor with no safeguards. There are two breaches: DNC (no clear consent or registry check) and transfer limitation (no comparable protection). Penalty exposure reaches S$1 million or 10% of Singapore turnover, whichever is higher, for organizations with turnover above S$10 million.
Traps
- Assuming consent is always required; deemed consent and exceptions exist.
- Confusing PDPC breach notification with notification to individuals.
- Treating the DNC Registry as applying to all communications rather than marketing to Singapore numbers.