Introduction to the PDPA Framework
Singapore's Personal Data Protection Act 2012 (PDPA) provides the primary legal framework for the responsible collection, use and disclosure of personal data by organisations. PDPA recognises both the individual's right to data protection and an organisation's legitimate need to use personal data. We have outlined below some of the important elements of the PDPA and checklists that an organisation can maintain to ensure compliance with the PDPA.
1. Applicability and Exemptions
The PDPA applies to almost all private organisations handling personal data of Singapore residents, whether electronically or in physical form. Exemptions apply to data over 100 years old, data of deceased individuals (over 10 years), data processed in personal/domestic capacities, and business contact information used in business contexts.
Checklist:
- Confirm if your organisation collects, uses or discloses personal data in Singapore.
- Identify if you act as an organisation (controller) or a data intermediary (processor).
- Understand the full scope of the PDPA and the eleven key obligations.
- Exclude business contact information unless used for personal purposes.
- Exclude data over 100 years old or relating to individuals deceased for over 10 years.
- Confirm if your data activities fall under domestic, employment or other exempt categories.
2. Definition and Scope of Personal Data
The PDPA defines "personal data" as data that can identify an individual, directly or indirectly. This includes customer lists and communications aimed at specific individuals. Courts have clarified that e-mail, or messaging content is not personal data unless accompanied by additional identifying information.
Checklist:
- Treat customer records and databases as personal data.
- Consider whether combined data could indirectly identify individuals.
- Regularly review data categories to ensure proper classification.
3. Consent and Notification Requirements
Before collecting data, organisations must inform individuals of the purpose, secure valid consent, and provide consent withdrawal mechanisms. Deceptive collection is prohibited. Consent may be deemed or waived in specific contexts (e.g. contractual necessity, public agency disclosures).
Checklist:
- Notify individuals of purpose before collection.
- Obtain consent for collection/use/disclosure.
- Allow individuals to withdraw consent at any time.
- Avoid bundling unnecessary consents with service terms.
- Train staff on proper consent practices.
- Review consent mechanisms and exceptions regularly.
4. Organisations vs Data Intermediaries
PDPA distinguishes between organisations and data intermediaries. Organisations must comply with all 11 obligations, while intermediaries are subject to data protection and retention obligations. Intermediaries must report data breaches to the organisation.
Checklist:
- Ensure intermediaries meet protection and retention standards.
- Define roles clearly in contracts: organisation vs intermediary.
- Monitor compliance by third-party data intermediaries.
5. Cross-Border Data Transfers
Data transfers outside Singapore require ensuring the overseas recipient provides "comparable protection". This includes legally enforceable agreements or recognised certifications. Even if stored or processed overseas, data under the organisation's control must meet all PDPA obligations.
Checklist:
- Ensure legal safeguards for cross-border transfers.
- Apply PDPA standards to overseas storage/processing.
- Maintain inventory of overseas data locations.
- Include overseas locations in your data retention and access policies.
6. Data Breach Notification
In the event of a notifiable data breach (e.g. affecting 500+ individuals or causing significant harm), organisations must notify the PDPC within 3 calendar days of the breach assessment. Affected individuals must be notified promptly unless exempted by the PDPC.
Checklist:
- Maintain a data breach response plan.
- Ensure intermediaries notify you of breaches promptly.
- Assess all potential data breaches to determine if they are notifiable (e.g., affecting ≥500 individuals or causing significant harm).
- Notify PDPC within 3 calendar days if applicable.
- Notify affected individuals where required.
- Document breach details, impact, and mitigation steps.
7. Accountability and Governance
The first step in ensuring that your organisation adheres to the compliance requirements under the PDPA is appointing a Data Protection Officer (DPO) irrespective of the size of your organisation as this is a regulatory requirement under the PDPA. Organisations are required to designate at least one individual as DPO. The DPO's contact details must be made publicly available so that individuals can raise queries or concerns. Organisations with limited internal resources may choose to outsource the DPO function. However, it is important to note that outsourcing does not absolve the organisation of its responsibilities under the PDPA. The organisation remains fully accountable for compliance.
Checklist:
- Appoint at least one Data Protection Officer (internal or external resource)
- Publish DPO contact details on your website or in public-facing documents.
- Ensure the DPO is adequately trained and supported.
- Develop and maintain internal data protection policies and practices.
- Train employees regularly on data protection obligations.
- Maintain evidence of compliance with the PDPA.
- If outsourcing the DPO function, ensure the service provider is qualified and contractually bound to carry out the role effectively.
- Maintain oversight of the outsourced DPO's activities and provide necessary access to internal processes and systems.
- Ensure that the outsourced DPO is well-versed with the organisation's operations, data flows, and risks.
- Hold periodic briefings to ensure the outsourced DPO stays updated with any change in the organisations business that might impact data.
- Establish a workflow such that the outsourced DPO can handle data subject requests and report data breaches within the statutory timelines.
Conclusion
Compliance with Singapore's PDPA is not just a regulatory necessity it is a core component of building trust with customers, stakeholders, and partners. By proactively understanding your obligations and implementing the necessary policies, processes, and tools, your organisation can mitigate data protection risks, enhance operational resilience, and foster a culture of accountability. Use this checklist as a foundational guide but also ensure continuous monitoring of any changes to the PDPA and improvement in your internal policies to keep pace with evolving regulations and business practices. The Personal Data Protection Commission of Singapore provides useful resources for organisations to navigate compliance with the PDPA
While the checklist in this blog post serves as a helpful internal tool, it is equally important for organisations to be able to produce documentary evidence of compliance when required by regulators. This includes maintaining records of consent, data protection policies, training logs, breach response actions, and DPO-related documentation. In short, proof that they have complied with the PDPA compliance obligations.
How Komrisk can simplify your PDPA Compliance journey?
Komrisk, our compliance risk management solution, can play a critical role in your compliance journey. Komrisk functions as a repository of relevant compliance obligations for the PDPA and other legislation in the form of simple actionable tasks. With the ability to upload tangible evidence of compliance, Komrisk validates the completion of compliance tasks by helping organisations streamline compliance tracking, centralise documentation, and generate audit-ready reports when required. By evaluating potential risks associated with pending compliances across all entities, operating units, and departments, Komrisk offers a comprehensive, real-time view of the organisation's compliance landscape, helping to identify gaps and prioritise actions effectively.
Ready to simplify your compliance journey? Try Komrisk today and take control of your PDPA obligations with confidence.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
