Singapore PDPA Compliance

Overview

Singapore's Personal Data Protection Act 2012 (PDPA, No. 26 of 2012) was enacted on 15 October 2012 and took effect in phases, with the main data protection provisions effective from 2 July 2014. Significant amendments in 2020 (effective 1 February 2021) introduced mandatory breach notification, deemed consent by notification, a data portability obligation, and enhanced enforcement powers.

The Personal Data Protection Commission (PDPC) is the regulatory authority, operating under the Infocomm Media Development Authority (IMDA). The PDPC issues Advisory Guidelines that provide detailed interpretation of the PDPA.

Key PDPA Obligations (Nine Obligations)

The Nine Obligations Framework

Obligation	PDPA Section	Description
Consent	Part IV, Division 1	Obtain consent for collection, use, and disclosure; notify of purposes
Purpose Limitation	Section 18	Collect, use, or disclose only for purposes a reasonable person would consider appropriate
Notification	Section 20	Notify individuals of purposes before or at the time of collection
Access	Section 21	Provide individuals access to their personal data upon request
Correction	Section 22	Correct errors or omissions in personal data upon request
Accuracy	Section 23	Make reasonable effort to ensure personal data is accurate and complete
Protection	Section 24	Protect personal data with reasonable security arrangements
Retention Limitation	Section 25	Retain personal data only as long as necessary for business or legal purposes
Transfer Limitation	Section 26	Transfer overseas only to jurisdictions with comparable protection
Data Breach Notification	Part VIA	Notify PDPC and affected individuals of notifiable data breaches

Consent Framework

Types of Consent Under PDPA

Consent Type	Provision	Description
Express consent	Section 14	Explicit consent given orally, in writing, or electronically
Deemed consent by conduct	Section 15	Consent inferred from voluntary provision of data for a stated purpose
Deemed consent by notification	Section 15A (2020 amendment)	Consent deemed after notification with reasonable opt-out period and no opt-out exercised
Deemed consent by contractual necessity	Section 15A(2)	Consent deemed for disclosure necessary to perform a contract with the individual

Deemed Consent by Notification (Section 15A)

Requirements for valid deemed consent by notification:

1. The organisation has conducted an assessment and determined that the collection, use, or disclosure is unlikely to have an adverse effect on the individual
2. The organisation has taken reasonable steps to notify the individual (or bring to attention) of the purpose and that consent will be deemed
3. The organisation has provided a reasonable period for the individual to opt out
4. The individual has not opted out within the stated period

Exceptions to Consent (Second, Third, and Fourth Schedules)

Exception Category	Examples
Business improvement	Using personal data for improving/developing products and services (reasonable expectation standard)
Legal and business purposes	Debt recovery, insurance claims, legal proceedings
National interest	National security, public health emergencies
Publicly available	Data made publicly available by law or the individual
Vital interests	Emergency affecting life, health, or safety
Research	Research and statistics with anonymisation safeguards

Do Not Call (DNC) Registry (Part IX)

DNC Obligations

Element	Detail
Scope	Marketing messages sent to Singapore telephone numbers via voice calls, text messages, or fax
Registry types	No Voice Call Register, No Text Message Register, No Fax Message Register
Check obligation	Organisations must check the DNC Registry before sending marketing messages to Singapore numbers
Check validity	DNC check results valid for 30 days
Exemptions	Messages to existing customers regarding similar products/services (with opt-out); messages with express consent documented
Penalties	Up to SGD 1 million per breach; financial penalties imposed by the PDPC

Zenith Global Enterprises DNC Compliance

Element	Detail
DNC checking	Automated daily DNC register check before marketing campaign dispatch
Marketing channels	Email (not subject to DNC), SMS (DNC checked), phone calls (DNC checked)
Existing customer exemption	Applied for freight service-related communications with documented opt-out mechanism
Consent records	Documented express consent stored in CRM for opted-in customers

Data Intermediary Obligations (Section 4(2))

Definition

A data intermediary processes personal data on behalf of another organisation (the data controller) and does not use or disclose the data for its own purposes. Analogous to a "data processor" under GDPR.

Obligations

Obligation	Detail
Protection (Section 24)	Data intermediary must protect personal data in its possession or control
Retention (Section 25)	Must not retain personal data longer than necessary
Transfer (Section 26)	Transfer overseas restrictions apply
Breach notification (Part VIA)	Must notify the organisation (not the PDPC directly) of a data breach without unreasonable delay
No consent obligation	Data intermediary not required to obtain consent (this is the data controller's responsibility)

Zenith Global Enterprises Data Intermediary Register

Intermediary	Service	Data Processed	Contract Date
CloudServe Asia Pte Ltd	Cloud hosting	Customer and employee data	1 March 2025
LogiTech Solutions Pte Ltd	Customs IT platform	Customs clearance data	15 June 2025
PayGlobal Pte Ltd	Payment processing	Transaction data	1 January 2025

Mandatory Breach Notification (Part VIA)

Notifiable Data Breach Definition (Section 26B)

A data breach is notifiable if it results in, or is likely to result in:

• Significant harm to the affected individuals, OR
• Is of a significant scale (affecting 500 or more individuals)

Notification Requirements

Element	PDPC Notification	Individual Notification
When required	All notifiable data breaches	Breaches likely to result in significant harm
Timeline	As soon as practicable, not later than 3 calendar days of assessment completion	As soon as practicable after assessing the breach
Assessment deadline	Must assess within 30 calendar days of becoming aware of the breach	Same assessment period
Content	Nature, circumstances, data affected, number of individuals, steps taken, DPO contact	Nature of breach, steps individual can take, DPO contact

Significant Harm Criteria (Section 26B(2))

• Unauthorised access to or possession of prescribed personal data (NRIC numbers, financial account information, health information)
• Financial loss
• Physical harm
• Harassment
• Damage to reputation

Data Portability (Part VIB)

The 2020 amendments introduced a data portability obligation (effective date to be prescribed):

• Individuals may request their data be transmitted to another organisation
• Applies to data provided by the individual or arising from the individual's use of the organisation's services
• Porting organisation may charge a reasonable fee
• Technical framework being developed by the PDPC

Cross-Border Transfer (Section 26)

Transfer Requirements

Personal data may only be transferred outside Singapore if:

Condition	Detail
Comparable protection	The recipient country or organisation provides a standard of protection comparable to PDPA (Section 26(1))
Contractual safeguards	Legally enforceable obligations on the overseas recipient to provide comparable protection (PDPC-recommended approach)
Individual's consent	Consent with notification of inadequate overseas protection
Binding corporate rules	Within a corporate group with binding internal rules
PDPC-recognised framework	APEC CBPR certification or other PDPC-recognised mechanism

PDPC Advisory Guidelines on Cross-Border Transfers

• Contractual clauses with the overseas recipient are the most commonly used mechanism
• Must include: purpose limitation, security obligations, breach notification, sub-processing restrictions, access and correction facilitation
• No formal adequacy determination process (unlike GDPR)

Enforcement Framework

Financial Penalties (Section 48J, as amended 2020)

Entity Type	Maximum Penalty
Organisations	Up to SGD 1 million or 10% of annual turnover in Singapore (whichever is higher) for serious breaches
DNC violations	Up to SGD 1 million per breach

Notable PDPC Enforcement Decisions

SingHealth Breach (2019):

• Fine: SGD 250,000 to IHiS (IT agency) and SGD 750,000 to SingHealth
• Breach: Unauthorised access to patient records of 1.5 million patients, including Prime Minister's data
• Significance: Largest PDPC fine at the time; led to strengthened healthcare data protection measures

GrabCar (2021):

• Fine: SGD 10,000
• Violation: Unauthorised disclosure of passenger personal data in a data analytics feature
• Significance: Demonstrated PDPC enforcement on ride-hailing platforms

Razer (2022):

• Fine: SGD 50,000
• Violation: Failure to protect personal data of approximately 100,000 customers
• Significance: Server misconfiguration leading to data exposure

Compliance Programme

Component	Detail
DPO (Singapore)	Tan Wei Lin, Data Protection Manager — Singapore office
Contact	dpo-sg@zenithglobal.com.sg
Privacy notice	Published at zenithglobal.com.sg/privacy
Consent framework	Express consent for marketing; deemed consent by conduct for service provision
DNC compliance	Automated DNC register checking; 30-day check validity
Breach notification	30-day assessment + 3-day PDPC notification workflow
Data intermediary management	Contractual clauses with all intermediaries per PDPC guidelines
Cross-border transfers	Contractual safeguards with overseas recipients
Data subject rights	Access and correction within 30 days; fees per PDPC guidelines