Last updated
If your Singapore company holds customer names, staff files or enquiry forms, the Personal Data Protection Act (PDPA) applies to you. The regulator is the Personal Data Protection Commission (PDPC). One rule is exact: the PDPC says serious breaches are reported within 3 calendar days. We read what the PDPC would let us on . Several of its obligation pages did not load for us, and we mark below what we could not check.
Does the PDPA apply to your company?
Yes, if the company collects, uses or discloses personal data in Singapore. That covers a customer list, a website contact form, job applicants, payroll records and copies of passports or ID cards. Starting a company does not exempt you. The PDPC pages we could read show no size cut-off for the main duties.
What does the PDPA ask you to do?
The PDPC groups the duties into obligations. Based on the PDPC listing, the ones that matter for most new companies are:
- Notification: tell people why you collect, use or disclose their data.
- Consent: use data only for purposes the person agreed to.
- Accuracy: make a reasonable effort to keep data correct, especially when you use it to decide something about a person.
- Protection: keep reasonable security in place against unauthorised access and loss.
- Data breach notification: report serious breaches, as set out below.
- Accountability: designate a data protection officer, make the officer's business contact details public, and have policies and a complaints process you can show on request.
The PDPC pages also cover retention, access and correction requests, transfers abroad and the Do Not Call rules for marketing messages. We could not open those pages, so we do not summarise them here. Read them before you run marketing campaigns by phone, text or chat app.
Who should be your data protection officer?
The PDPC treats naming a data protection officer as part of accountability. The law does not ask for a certain job title or a qualification in the pages we read. In a small company, that is usually a director, an operations manager or the person who runs the books. Pick someone with authority to change how staff handle data, and put their business contact details on your website.
A corporate service provider can offer outsourced data protection services. We have not seen published prices from the PDPC for this, so ask for a written scope and fee.
When must you report a data breach?
| Item | Rule from the PDPC |
|---|---|
| Report to | The PDPC |
| When | Within 3 calendar days |
| Trigger | A breach affecting 500 or more individuals, or causing significant harm |
| Also tell | The affected individuals |
A lost laptop with an unencrypted customer list is a typical case. A mis-sent email to three people is usually not. The PDPC wants you to assess the breach quickly, so write down who decides, who calls the PDPC and who writes to customers before anything happens.
What is the penalty?
We do not quote one. The PDPC publishes enforcement guidelines and named decisions, and a figure you read on a consultant's page may be out of date. Look at the PDPC's enforcement guidelines, and at recent decisions, to see how it has treated companies of your size.
A first-month plan for a new company
- Name your data protection officer and publish their business contact details.
- List what personal data you hold, where it sits and who can see it. Customer lists, payroll, email and cloud folders count.
- Write a short privacy notice for your website and sign-up forms.
- Limit access. Staff should see only what they need.
- Decide how long you keep records. Tax and company law may require some, such as accounting records, so ask your accountant before you delete anything.
- Agree a breach plan with names and phone numbers inside the company.
- If you hire foreign staff or run CPF, their ID and pay records are covered as well.
Independent guide, not the PDPC
SingaporeCompanySetupGuide.com is an independent guide. We are not the PDPC, and this page is not legal advice. Partners pay us when a request is passed to them. If you want a provider to help with company records or compliance, the next-step page has a quote form. For a clean start, see setting up a company in Singapore.
Sources
- PDPC, Data breach notification, https://www.pdpc.gov.sg/complaints-and-reports/data-breach-notification (3 calendar days, 500 individuals or significant harm, notify individuals)
- PDPC, Data protection obligations, https://www.pdpc.gov.sg/overview-of-pdpa/the-legislation/personal-data-protection-act/data-protection-obligations (list of obligations, accountability and the data protection officer; the page did not load in full for us)
