An interactive guide to Singapore's data protection regime: one Act, six operating Regulations, eleven obligations, three Do Not Call registers, and a four-tier enforcement pathway from review to High Court. Cross-referenced, mapped, and built to read.
The PDPA is a small constitution. The Act sets the principles; six subsidiary Regulations operationalise each Part. Knowing which Regulation governs which provision is half the battle of compliance, so the map below reads in two directions: by instrument, and by Act provision.
Together, Parts 3 through 6A of the Act impose eleven discrete duties on every organisation that collects, uses, or discloses personal data in Singapore. Treat them as a checklist for any new product, vendor, or process that touches personal data.
Collect, use, or disclose personal data only with the individual's consent, expressed or deemed. Consent obtained by deception or false information is invalid.
Collect, use, or disclose only for purposes a reasonable person would consider appropriate in the circumstances, and only for purposes the individual has been notified of.
Notify the individual of the purposes for which their personal data will be collected, used, or disclosed, on or before the collection.
On request, provide the individual with their personal data and information about how it has been used or disclosed in the year before the request, and correct errors.
Make a reasonable effort to ensure personal data is accurate and complete if it is likely to be used to make a decision affecting the individual or disclosed to another organisation.
Make reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification, or disposal of personal data.
Cease retention or anonymise personal data as soon as the purpose for which it was collected is no longer served and retention is no longer necessary for legal or business reasons.
Before transferring personal data outside Singapore, ensure the recipient is bound by legally enforceable obligations to provide a comparable standard of protection.
Develop and implement policies and practices to comply with the Act, designate a Data Protection Officer with publicly available business contact information, and make these policies available on request.
Assess any data breach without delay; notify the PDPC within 3 calendar days, and affected individuals as soon as practicable, where the breach is notifiable.
On request, transmit an individual's data in machine-readable form to another organisation. Introduced by Act 40/2020 with operative provisions to be commenced.
Not every breach must be reported. Under section 26B, a breach becomes notifiable if it crosses either of two tests, harm or scale. Once an organisation has reason to believe a breach has occurred, the assessment must begin without delay; the moment that assessment confirms it is notifiable, a 3-day clock starts ticking to the PDPC.
A breach is deemed to result in significant harm to an individual if it relates to either (a) the individual's full name or identification number plus any of the prescribed categories of personal data, or (b) the individual's account identifier with login or biometric credentials.
Independently of harm, a breach is notifiable if it affects, or is likely to affect, 500 or more individuals. Where the exact number is not yet known, the organisation must still notify and update the figure as the investigation matures.
Singapore runs a per-channel opt-out system. Subscribers register the same number on as many lists as they wish; senders must check the register relevant to the channel they intend to use within 21 days of sending. Under section 43A, a checker reselling DNC results must pass on the date of check and the expiry date.
Specified messages sent by voice call or video call using a telephone, data service, or any other electronic means are subject to the voice register.
Covers text, sound, or visual messages sent to a Singapore telephone number, including SMS and MMS. Excludes fax and voice messages.
Specified messages sent by way of facsimile transmission. Mostly relevant for B2B-facing senders that still use fax for marketing in regulated sectors.
Personal data leaves Singapore frequently, but section 26 only permits a transfer if the recipient is bound to a comparable standard of protection. Regulation 11 of the Personal Data Protection Regulations 2021 lists exactly how that binding may arise. Pick one route and document it before any data leaves.
The recipient is already bound by the law of the destination country to a comparable standard. Most useful where the destination has its own data protection statute with extra-territorial reach.
A bilateral contract that requires comparable protection and specifies the territories to which onward transfer is permitted. The most common route for vendor and processor relationships.
Group-wide BCRs binding intra-group recipients, used only between related entities, specifying the recipients, territories, rights, and obligations covered. Distinct from contract because it travels with the corporate group.
The recipient holds APEC CBPR certification, or APEC PRP certification if the recipient is a data intermediary. Useful when no contract is feasible and the recipient is in a participating economy.
Consent is the default basis for collection, use, and disclosure, but the Act recognises five routes by which an organisation may lawfully process data. Each rung climbs further from express opt-in and demands more justification.
From a complaint to a final ruling, the regime moves in five stages. Each stage carries its own time limit, fee, and procedural rules, and each Regulation in the stack governs a different stage. The same 28-day clock recurs at every gate.
The PDPA distinguishes administrative penalties on organisations from criminal liability of individuals from compoundable offences settled before prosecution. The three sit at different points on the severity scale and carry different procedural protections.
A guided walk through the Act's logic. Answer up to four questions to identify the regime that governs your situation and the obligations that follow. This is a heuristic for orientation; the binding text is the Act and its Regulations.