Singapore's PDPA: What Business Owners Need to Know to Avoid Penalties
The Personal Data Protection Act (PDPA) governs how organisations in Singapore collect, use, disclose, and protect personal data. With the Personal Data Protection Commission (PDPC) increasingly active in enforcement, every Singapore business must have a clear data protection posture.
Key Obligations Under the PDPA
- Consent: Obtain clear, informed consent before collecting personal data
- Purpose limitation: Only collect data for specified, legitimate purposes
- Access and correction: Allow individuals to access and correct their personal data
- Accuracy: Make reasonable efforts to ensure data is accurate and complete
- Protection: Implement reasonable security measures against unauthorised access or disclosure
- Retention limitation: Dispose of personal data when it is no longer needed
- Breach notification: Notify PDPC (and affected individuals in certain cases) within 3 days of a data breach
What Are the Penalties?
PDPC can impose financial penalties of up to S$1 million per breach, or 10% of annual Singapore turnover for organisations with annual turnover exceeding S$10 million — whichever is higher.
Practical First Steps
- Appoint a Data Protection Officer (DPO) — even part-time or outsourced
- Map all personal data your organisation processes
- Review your website privacy policy and consent forms
- Train staff on data protection obligations