PDPA compliance basics start with one idea: treat personal data as something customers lend you, not something you own. Singapore's Personal Data Protection Act (PDPA) sets the rules for how private firms handle personal data. In 2020, Parliament passed changes to it, and the new breach notice rule began on 1 February 2021. This guide covers what a small or mid-sized firm needs to know.
The core duties in plain words
The PDPA sets out data protection duties that apply to any organisation that collects, uses or shares personal data. Personal data means facts that can identify a person, such as a name, a phone number, an email address or a photo.
Here are the duties most firms meet every day. Get consent before you collect, use or share personal data, and let people withdraw it. Tell people why you need their data. Use the data only for those reasons. Let people see their data and fix mistakes. Take reasonable steps to keep the data accurate. Protect it with sensible security. Stop keeping it when you no longer need it. Send it abroad only if the data will still be protected.
The Act also asks every organisation to name at least one person to make sure it follows the Act, and to put its data policies in place and make information about them public. Customers should be able to find that person's business contact details.
Consent and purpose: ask first, then stick to the reason
Consent is the base of the law. Before you collect data, say what you will use it for. Then use it only for that purpose. If you want a new use later, ask again or check that an exception applies.
The 2020 changes added two ways consent can be deemed. The first is when you need the data to carry out a contract with the person. The second is when you notify people of the purpose, give them a fair chance to opt out, and first assess the risk to them.
The new law also adds a "legitimate interests" exception. It lets you use data without consent in limited cases, but only after you assess the risk to people and you tell them you rely on it. Treat it as a last resort, not a shortcut.
Protection and retention: what "reasonable" looks like
The Act asks for reasonable security. It does not name a tool or a price. It asks you to match your safeguards to how sensitive the data is and how much harm a leak could cause.
For a small firm, a practical start is simple. Use strong, unique passwords and turn on two-step sign-in where you can. Limit who can open customer files. Keep software up to date. Lock paper records away. Train staff to spot phishing emails.
Retention matters too. Set a date after which you delete or anonymise old records, such as lapsed customer lists. Data you no longer hold cannot be leaked.
The mandatory breach notice
The biggest change took effect on 1 February 2021. If a data breach is likely to cause significant harm to people, or affects 500 or more people, you must tell the PDPC. This is the "notifiable" test.
The clock matters. You must assess a suspected breach quickly and fairly. If it is notifiable, tell the PDPC as soon as you can, and no later than three calendar days after you decide it is notifiable. You must also tell the affected people if the breach is likely to cause them significant harm.
Delay is a risk of its own. The law expects you to assess a suspected breach promptly. So write down what you found and when.
A simple checklist to start this week
You do not need a large budget to get the basics right. Work through these steps in order.
First, name a data protection officer and share their contact details. Second, make a list of the personal data you hold, the place it is stored and your reason for collecting it. Third, check that your forms and sign-up pages say what you use the data for. Fourth, write a one-page breach plan that names who decides if a breach is notifiable and who calls the PDPC. Fifth, set delete dates for old records. Sixth, brief your staff, since most leaks start with a human slip.
The law also raises the top fine for larger firms. It sets the cap at 10 percent of annual Singapore turnover for firms above S$10 million, and the higher cap takes effect later. A plain, tested plan costs far less than a fine.
This is general information only. For your own firm, read the Act and the PDPC's guidance, and talk to a Singapore data protection lawyer before acting.