Summary: Singapore's Personal Data Protection Act sets clear expectations for collecting and using personal data online. Here are the essentials.
Organisations in Singapore must follow the Personal Data Protection Act (PDPA) when handling personal data. This is general guidance, not legal advice.
Key obligations
- Obtain consent and explain purposes when collecting personal data
- Use data only for purposes individuals would reasonably expect
- Protect data with reasonable security arrangements
- Allow access and correction requests
- Notify significant data breaches
Do Not Call rules
Marketing messages to Singapore phone numbers must respect the Do Not Call Registry.
Website essentials
Clear privacy notices, consent wording on forms and secure handling of submissions.
Appoint a data protection officer
Organisations are required to designate someone responsible for PDPA compliance.
FAQs
Does PDPA apply to small businesses?
Yes, it applies to most private organisations.
Is overseas hosting allowed?
Yes, with comparable protection for transferred data.
Who enforces PDPA?
The Personal Data Protection Commission (PDPC).
