PDPA compliance in Singapore means your business meets the Personal Data Protection Act 2012 duties for the personal data it holds. A notifiable data breach goes to the PDPC within 3 calendar days of you determining that it is notifiable. The PDPC caps a financial penalty at S$1 million, or 10% of annual Singapore turnover once that turnover exceeds S$10 million (PDPA s 48J, as of 5 November 2026). Name a data protection officer first, then fix consent, notices and your breach steps.
Accurate as of 5 November 2026. Every figure, date and rule on this page was checked against its source on that date, and the page is rechecked monthly.
The PDPA makes your business answerable for the personal data it holds or controls
Your business is responsible for personal data in its possession or under its control. Section 11(2) of the PDPA states that responsibility in one sentence. This guide covers the data protection obligations, breach notification, penalties and the Do Not Call (DNC) rules for private businesses. Sector rules from other regulators sit outside it.
Which data falls outside the PDPA?
Two groups of data fall outside the obligations: business contact information, and the data an employee handles while acting in the course of employment. Section 4(5) removes business contact information from Parts 3, 4, 5, 6 and 6A. Section 4(1)(b) excludes an employee acting in the course of employment. Personal data about your customers and leads stays inside the obligations unless it is business contact information.
Source: Singapore Statutes Online, November 2026
Each PDPA obligation maps to a record your business keeps
Each PDPA duty leaves a record that proves you met it, and the table pairs every duty with its section and that record. The last column is working practice, not a statutory list.
| Obligation | PDPA provision | What the Act requires | Record to keep |
|---|---|---|---|
| Accountability | s 11, s 12 | Designate individuals responsible for compliance, publish business contact information, develop policies and practices, and run a process to receive and respond to complaints | DPO name, policy set, complaints log |
| Consent | s 13, s 16 | No collection, use or disclosure of personal data without consent or a listed exception; individuals withdraw consent under s 16 | Consent wording, date and channel per person |
| Purpose limitation | s 18 | Use data only for purposes a reasonable person considers appropriate and the individual was told about | Purpose list per data set |
| Notification | s 20 | Tell the individual the purposes on or before collection | Notice text with version dates |
| Access | s 21 | Give the individual their data as soon as reasonably possible; refuse where it reveals another person's data or is contrary to the national interest | Request log with received and answered dates |
| Correction | s 22 | Correct an error or omission as soon as practicable | Correction log |
| Accuracy | s 23 | Make a reasonable effort to keep data accurate and complete when it informs a decision about the person or goes to another organisation | Data-quality checks |
| Protection | s 24 | Make reasonable security arrangements | Security measures register, vendor reviews |
| Retention limitation | s 25 | Cease to retain documents once the purpose is no longer served and retention is no longer necessary for legal or business purposes | Retention schedule with deletion dates |
| Transfer limitation | s 26 | Restrict transfers of personal data to a country or territory outside Singapore | Transfer register |
| Data breach notification | s 26B to 26D | Assess a suspected breach, then notify the PDPC within 3 calendar days of determining it is notifiable | Incident log |
What each PDPA data protection obligation requires and the record that evidences it, section numbers as in the Act version in force from 1 October 2022, checked 5 November 2026.
Source: Singapore Statutes Online, November 2026
How fast does a business answer an access or correction request?
The Act sets no fixed day count for either request: access is due as soon as reasonably possible (s 21) and correction as soon as practicable (s 22). An internal target with a dated request log is the practical way to show the PDPC that your pace was reasonable. Section 21(3) lists the grounds to refuse access, including data that reveals personal data about another individual.
Source: Singapore Statutes Online, November 2026
Does the PDPA give individuals a right to erasure or data portability?
The Act text gives individuals access, correction and withdrawal of consent, and it places the duty to stop holding data on the organisation through section 25. The version in force from 1 October 2022 lists Part 6A and then Part 7 in its arrangement of sections, so no data portability Part is in the in-force text. Deletion therefore turns on withdrawal of consent (s 16) and the retention duty (s 25).
Source: Singapore Statutes Online, November 2026
A notifiable data breach starts a 3-calendar-day clock to the PDPC
You report a notifiable breach to the PDPC no later than 3 calendar days after you determine it is notifiable, and you tell affected individuals at the same time or after. Calendar days include weekends and public holidays. The breach rules sit in sections 26B to 26D of the Act and in the PDPC's breach guide, revised 15 March 2021.
What makes a data breach notifiable?
A breach is notifiable when it is likely to cause significant harm to an affected individual, or when it involves the personal data of 500 or more individuals. The PDP (Notification of Data Breaches) Regulations 2021 list the data that counts as significant harm if compromised. Where the number of people is unknown, you notify once you have reason to believe at least 500 are affected.
| Scenario | Test met | Notify the PDPC | Notify affected individuals |
|---|---|---|---|
| Prescribed data exposed, any number of people | Significant harm | Yes, within 3 calendar days | Yes, at the same time or after |
| No prescribed data, 500 or more people | Significant scale | Yes, within 3 calendar days | Not required by the scale test alone |
| No prescribed data, fewer than 500 people | Neither test | No notification duty | No notification duty |
| Prescribed data exposed, but action taken beforehand or afterwards makes significant harm unlikely | Significant harm, with a s 26D(5) exception | Yes, within 3 calendar days | Exception applies if the action meets the prescribed requirements |
Which notification applies by breach scenario, from the Act and the PDPC breach guide, checked 5 November 2026.
Source: Singapore Statutes Online, November 2026
How many days do you have to assess and report a breach?
You have 30 calendar days to assess whether a suspected breach is notifiable, then 3 calendar days to notify the PDPC once you determine that it is. The PDPC guide sets the 30 days from the moment you have credible grounds to believe a breach occurred. It counts the first of the 3 days as the day after your determination, so a Friday determination runs out on the Monday.
| Step | Illustrative date | Rule applied | Source |
|---|---|---|---|
| Determination that the breach is notifiable | Friday 6 November 2026 | Start of the 3-day period | PDPC breach guide |
| Day 1 | Saturday 7 November 2026 | First day is the day after determination | PDPC breach guide |
| Day 2 | Sunday 8 November 2026 | Weekends count | PDPC breach guide |
| Day 3, last day to notify the PDPC | Monday 9 November 2026 | No later than 3 calendar days | PDPA s 26D(1) |
Worked 3-calendar-day count from a hypothetical determination date, not a real incident.
What does the breach notification contain?
The PDPC notification states the facts, your handling of the breach and the contact details of at least one authorised representative. The facts cover when and how you became aware, how the breach occurred, the number of people affected, the data classes involved and the potential harm. The handling section gives a chronological account of your steps, your notifiability assessment and your plan to inform individuals. A late notification adds the reasons for the delay and the supporting evidence. Meeting another law's breach-reporting duty does not by itself satisfy the PDPA duty.
Where do you report a breach?
You report through the PDPC e-service form, after running the PDPC self-assessment for organisations experiencing data breaches. The PDPC's page on reporting an organisation's data breach links both the self-assessment tool and the form at eservice.pdpc.gov.sg. The same page links the breach guide that sets out the C.A.R.E. framework, checklists and post-breach evaluation.
The PDPC fine cap rises with turnover above S$10 million
The PDPC caps a financial penalty at S$1 million for an organisation with annual Singapore turnover of S$10 million or less, and at 10% of that turnover above S$10 million. The caps took effect on 1 October 2022. Section 48J(5A) takes annual turnover from the most recent audited accounts available when the penalty is imposed.
| Annual turnover in Singapore | Cap rule | Maximum financial penalty | Arithmetic |
|---|---|---|---|
| S$5 million | Any other case | S$1 million | Fixed cap |
| S$10 million | Any other case (turnover does not exceed S$10 million) | S$1 million | Fixed cap |
| S$50 million | 10% of turnover | S$5 million | 0.10 x 50,000,000 |
| S$200 million | 10% of turnover | S$20 million | 0.10 x 200,000,000 |
| S$1 billion | 10% of turnover | S$100 million | 0.10 x 1,000,000,000 |
Maximum PDPA financial penalty by annual Singapore turnover, s 48J, in force from 1 October 2022, checked 5 November 2026.
Source: Singapore Statutes Online, November 2026
What do real PDPC penalties look like next to the cap?
Two recent PDPC decisions imposed S$315,000 for a breach affecting 665,495 members and S$17,500 for a breach affecting 190,589 individuals. Both found a breach of the Protection Obligation under section 24, and both sit below S$1 million, the lowest cap that applies to any organisation.
| Decision | Individuals affected | Financial penalty | Penalty per individual |
|---|---|---|---|
| Marina Bay Sands Pte Ltd, 28 October 2025 | 665,495 | S$315,000 | S$0.47 |
| Ezynetic Pte Ltd, [2025] SGPDPCS 2 | 190,589 | S$17,500 | S$0.09 |
Penalty per individual is the penalty divided by individuals affected, rounded to the cent; 315,000 / 665,495 = 0.473 and 17,500 / 190,589 = 0.092.
The Marina Bay Sands penalty started as a preliminary S$450,000 and fell to S$315,000 after representations. A manual API migration error left one app identifier out of the inventory, so a token verification policy missed that page and a threat actor exported member data. Ezynetic failed on weak access controls and on periodic vulnerability assessments and penetration testing.
[Source: PDPC, November 2026
What does the PDPC weigh when it sets a penalty?
The PDPC weighs how serious and how long the failure was, what data it touched, what you did to limit harm and whether you failed before. The enforcement guidelines list the nature, gravity and duration of the non-compliance, the type of personal data, any financial benefit gained, mitigating action and its timing, the compliance measures already in place, previous failures, and whether the penalty is proportionate. The likely impact on the organisation's ability to continue operating is also on the list.
Is a voluntary undertaking an admission of breach?
No, a written voluntary undertaking accepted by the PDPC does not amount to an admission of breach. The request comes soon after the incident is known and carries a remediation plan. The PDPC is unlikely to accept one where the organisation refutes responsibility, the incident repeats or the breach is wilful or egregious.
Are individual employees personally liable under the PDPA?
Yes, an individual who makes an unauthorised disclosure, improper use or unauthorised re-identification of personal data commits an offence under sections 48D to 48F. Each section carries a fine of up to S$5,000, imprisonment of up to 2 years, or both. The organisation's duty is separate, so a staff member's offence does not remove the organisation's own responsibility.
Source: Singapore Statutes Online, November 2026
Your data protection officer owns the compliance programme
A named DPO turns the PDPA from a legal text into a set of owned tasks: policies, the complaints process, staff training and the breach plan. Section 11(3) requires an organisation to designate one or more individuals responsible for ensuring compliance, and section 11(5) requires business contact information to be made available to the public. The duties of the role sit alongside the licences, taxes and filings in the business compliance guide.
Does a small business have to designate a DPO?
Yes, section 11(3) applies to "an organisation" and designates one or more individuals as responsible, with no size qualifier in its opening words. One person covers the role in a small team, and the PDPC runs a DPO Registry where an organisation submits or updates its DPO's details. The PDPC also lists a three-day Fundamentals of PDPA course for new DPOs.
Source: Singapore Statutes Online, November 2026
Which PDPC tools help a small business start?
The PDPC lists four starting tools on its DPO page: the Data Protection Essentials Framework, the Data Protection Notice Generator, the PDPA Assessment Tool for Organisations and the Advisory Guidelines. The same page links the Sector-specific Guidelines for regulated industries and the three-day course for new DPOs.
Marketing messages to Singapore numbers need a DNC check or evidenced consent
Before you send a specified message to a Singapore telephone number, you check the DNC Registers, unless the person gave clear and unambiguous consent in evidential form. A specified message is one whose purpose, or one of its purposes, is to advertise or offer goods, services, land or a business or investment opportunity. The DNC rules sit in the PDPA, alongside the data protection obligations, and carry their own clocks.
| Rule | PDPA provision | Requirement | Business action |
|---|---|---|---|
| Registers | Part 9 | Three DNC Registers cover voice call, text message and fax; numbers have 8 digits starting with 3, 6, 8 or 9 | Screen lists against the register that matches the channel |
| Check before sending | s 43 | Check the register unless consent is clear, unambiguous and in evidential form | Store the consent record with the number |
| Result validity | s 43 | Check results are valid for 21 days from receipt | Re-check any list older than 21 days |
| Sender identity | s 44 | Include identification and contact information, likely valid for at least 30 days after sending | Avoid short codes, no-reply addresses and a physical address alone |
| Withdrawal | s 47 | Effect a withdrawal of consent within 21 days; do not prevent withdrawal | Build an opt-out that updates within 21 days |
DNC obligations for specified messages, as in the PDPC Advisory Guidelines on the Do Not Call Provisions revised 1 February 2021, checked 5 November 2026.
Do WhatsApp and other app messages count under the DNC rules?
Yes, the PDPC guidelines cover data apps that use a Singapore number, such as WhatsApp, iMessage and Viber. A message to a number on the No Text Message Register therefore needs the same check or consent as an SMS. Consent for one channel does not automatically cover another channel, and a failure to opt out is unlikely to count as consent.
Are business-to-business messages exempt from the DNC rules?
Messages sent to an organisation for that organisation's purposes are excluded, as are messages in an ongoing relationship, transactional messages and market research. Paragraph 1(e) of the Eighth Schedule requires the message's sole purpose to relate to the ongoing relationship, and a once-off transaction does not create one. Consent records belong in the contact system your team already runs, and the CRM software guide compares such systems.
Five PDPA clocks govern your response, and the breach clock is the shortest
The PDPA and its guidance run five time limits that count in days, and the shortest is the 3 calendar days for a PDPC breach notification. The table orders them from shortest to longest. The access and correction duties carry no day count in the Act, so they sit outside it.
| Clock | Length | Trigger | Source |
|---|---|---|---|
| Notify the PDPC of a notifiable breach | No later than 3 calendar days | You determine the breach is notifiable | PDPA s 26D(1) |
| Re-check the DNC Register | 21 days | Receipt of the check results | PDPC DNC Advisory Guidelines |
| Effect a withdrawal of DNC consent | 21 days | Notice of withdrawal | PDPA s 47(3), PDPC DNC Advisory Guidelines |
| Keep sender contact details valid | At least 30 days | Sending the message | PDPA s 44, PDPC DNC Advisory Guidelines |
| Assess whether a suspected breach is notifiable | 30 calendar days | Credible grounds to believe a breach occurred | PDPC breach guide |
PDPA time limits ordered by length, checked 5 November 2026.
General guidance as of 5 November 2026, not legal advice.