Regulations › Rest of world › Singapore
PDPA (SG)
Personal Data Protection Act 2012 (Singapore)
WhenIn effect since 2 July 2014
Who enforces itPersonal Data Protection Commission
Who it applies toOrganizations collecting, using or disclosing personal data in Singapore.
Tell the regulatorAfter assessing a breach as notifiable, notify the PDPC as soon as practicable and no later th…
DPO requiredEvery organization must designate one or more individuals responsible for PDPA compliance and…
RegistrationNo controller registration
Transfers abroadTransfers only under prescribed requirements ensuring a comparable standard of protection (con…
Request deadlineAccess as soon as reasonably possible
Maximum fineUp to 10% of annual Singapore turnover if over SGD 10 million, otherwise SGD 1 million
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Reach and lawful basis
Reach abroad
2
Applies to organizations whether or not resident or with an office in Singapore, in practice when collecting, using or disclosing data in Singapore.s.2(1) ('organisation') · source ↗
PDPC guidance on territorial reach could not be fetched (robots blocked).
Lawful basis
1
Consent, deemed consent, or exceptions in the First and Second Schedules, including a legitimate interests exception.ss.13, 15, 15A, 17; First Schedule Part 3 · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
Consent
0
Deemed consent by conduct, contract or notification with opt-out window is valid; no written form required.ss.14, 15, 15A · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
Sensitive data
0
No statutory special category; PDPC treats some data as sensitive when assessing security and penalties.Not addressed · source ↗
Children
1
PDPC guidance: children 13 to 17 may consent if notices are understandable; under 13 need parent or guardian consent.PDPC Advisory Guidelines on Children's Personal Data (28 Mar 2024) · secondary source · source ↗
Guidance, not statute. PDPC site blocked; CMS summary used.
People's rights
Rights
1
Access and correction; data portability enacted but not yet in force; right to withdraw consent.ss.16, 21, 22; Part 6B · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text. Counted: access, correction.
Request deadline
2
Access as soon as reasonably possible; PDPC guidance and regulations set 30 days or notice of a longer time.s.21(1); PDP Regulations 2021 · secondary source · source ↗
30-day period not in the Act text read; regulation number not confirmed.
Marketing
1
Check the Do Not Call Register before marketing calls or texts unless clear consent; marketing use of data also needs consent.Part 9 (s.43); s.13 · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text. Section 43 text not read in detail; Spam Control Act separately covers bulk electronic messages.
Governance
DPO required
3
Every organization must designate one or more individuals responsible for PDPA compliance and publish business contact information.s.11(3), (5) · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
DPO qualifications
0
No qualification, certification or residency requirement.s.11(3) · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text. PDPC encourages training and DPO competency frameworks (non-binding).
DPIA
1
DPIAs recommended; assessments required before relying on deemed consent by notification or the legitimate interests exception.s.15A; First Schedule Part 3 · secondary source · source ↗
Assessment duties per statute; DPIA encouragement in PDPC guidelines.
Records
0
No record of processing requirement; organizations must document policies and practices.s.12 · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
Retention
1
Cease retention or anonymize once the purpose is no longer served and no legal or business need remains.s.25 · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
Breaches
Tell the regulator
2
After assessing a breach as notifiable, notify the PDPC as soon as practicable and no later than 3 calendar days.s.26D(1) · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
Tell people
2
Notify affected individuals where significant harm is likely, unless remediation or safeguards make harm unlikely.s.26D(2), (5) · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
Transfers
Transfers abroad
2
Transfers only under prescribed requirements ensuring a comparable standard of protection (contracts, BCRs, certification, consent).s.26(1) · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text. Mechanisms are in the PDP Regulations 2021 (not read).
Enforcement
Maximum fine
3
Up to 10% of annual Singapore turnover if over SGD 10 million, otherwise SGD 1 million.s.48J(3) · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
Criminal liability
2
Individuals face up to SGD 5,000 and 2 years' imprisonment for unauthorized disclosure, improper use or re-identification.ss.48D-48F · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
Private action
2
Persons suffering loss or damage may sue for injunction, declaration, damages or other relief.s.48O · secondary source · source ↗
Read on LawPlayer, a reproduction of Singapore Statutes Online text.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws