In this guide · 8 sections
Short answer
Do a DPIA before launching a new system or process that handles personal data, or before a major change. List the data and its flows, rate each risk by likelihood x impact on a 1 to 5 scale, fix anything rated 15 or more first, and get the owner or DPO to sign off.
What a DPIA is and when SMEs need one
PDPC's Guide to Data Protection Impact Assessments describes a DPIA as identifying, assessing and addressing personal data protection risks for a system or process. It is a key part of data protection by design: fixing problems at the design stage, when changes are cheaper.
For most businesses a DPIA is good practice rather than a legal requirement. There are two exceptions where the PDPA itself requires an assessment: before relying on deemed consent by notification (section 15A) and before relying on the legitimate interests exception, as explained in PDPC's Advisory Guidelines on Key Concepts. This is general information, not legal advice.
| Trigger (from PDPC's guide) | SME examples |
|---|---|
| New system handling personal data | New CRM, booking system, website with forms, AI chatbot |
| New process, including manual ones | Visitor log at reception, paper forms scanned to the cloud |
| Change to an existing system or process | Moving customer records from spreadsheets to a cloud app |
| Organisation change affecting data handling | Merging with another business, outsourcing HR |
| Collecting new types of personal data | Adding NRIC, health or biometric data; installing CCTV |
The six DPIA phases, condensed
PDPC's guide sets out six phases. For a small business, each phase becomes a section of a short document.
1. Assess the need
Does the project involve personal data? Is it new, substantially redesigned, or collecting new types of data? If yes to any, do a DPIA.
2. Plan it
Write a paragraph on the project, its scope, who is involved (owner, DPO, IT, the vendor) and the timeline. Agree the risk rating method.
3. Map data and flows
List each type of personal data, why you collect it, and how it moves: collection, storage, use, sharing, retention and disposal. Note who can access it.
4. Identify and rate risks
Check each flow against the PDPA obligations and rate each risk for likelihood and impact.
5. Create an action plan
For each risk, decide the fix, the owner and the deadline. Risks above your threshold must be fixed before launch.
6. Implement and monitor
Confirm fixes are done, get sign-off, and set a review date or trigger.
If you already keep a data inventory, phase 3 is mostly copy and paste. Our personal data inventory template gives you the columns.
Questions to ask for each data flow
These are drawn from the sample questionnaire in PDPC's guide and the PDPA obligations. Answer each in a sentence.
DPIA questions
Vendor contracts are a frequent gap. Our guide to data processor agreements under the PDPA lists the clauses to ask for.
Rating risk: likelihood x impact
PDPC's guide gives an example framework in Annex A: rate likelihood and impact each from 1 to 5, multiply them, and treat any risk rated 15 or more as an immediate priority. You can use different scales, but write them down so ratings are consistent.
| Score | Likelihood | Impact on individuals |
|---|---|---|
| 1 | Very unlikely | Minor inconvenience |
| 2 | Unlikely | Some inconvenience, easily fixed |
| 3 | Possible | Significant inconvenience or minor financial loss |
| 4 | Likely | Financial loss, distress or reputational harm |
| 5 | Almost certain | Serious harm: identity fraud, health or safety risk |
PDPC's guide lists treatment options: remove the source of the risk, reduce its likelihood, share it through contracts or insurance, or accept it as an informed decision. Write down which you chose for each high risk and why.
A one-page DPIA template
Copy these headings into a document. A small project fits on one or two pages.
- Project: name, owner, go-live date, vendor.
- Why a DPIA: which trigger applies.
- Personal data: types, number of people affected, any sensitive data such as NRIC, health or financial details.
- Data flow: collection, storage location, access, sharing, retention, deletion.
- Risks: one line each, with likelihood, impact and rating.
- Actions: fix, owner, deadline, done yes or no.
- Residual risk: what remains after the fixes, and whether it is accepted.
- Sign-off: owner or director and DPO, with date.
- Review: date or event that triggers a review, such as a new vendor or new data type.
Common DPIA mistakes
- Doing it after launch. PDPC's point is to change the design while it is still cheap. A DPIA written after go-live usually just documents problems.
- Skipping the vendor. Most SME systems are cloud apps. Ask the vendor where data is stored, who can access it and how deletion works, and record the answers.
- Only rating security. Notification, consent, retention and access requests are PDPA obligations too, and are often where SMEs fall short.
- No owner for actions. Every action needs a name and a date, or it does not happen.
- Never reviewing. A DPIA goes stale when the vendor, features or data change. AI tools change often; review those at least yearly.
Do it yourself or get help?
A business owner or DPO can complete a DPIA for a straightforward project in an afternoon using the template above. Get help when the project involves health, financial or children's data, large volumes, or data leaving Singapore.
IT Sorted's PDPA Compliance Pack (S$690) covers the groundwork a DPIA relies on: a personal data inventory, privacy policy, staff data protection policy and a breach response plan. We are not lawyers and do not act as your DPO; for legal questions, consult a lawyer.
Frequently asked questions
Not in general. PDPC encourages DPIAs for new or changed systems and processes. However, the PDPA does require an assessment before an organisation relies on deemed consent by notification or the legitimate interests exception. Some sector regulators and contracts may also require one. This is general information, not legal advice.
Before launching a new system or process that handles personal data, when redesigning an existing one, when changing vendors, or when starting to collect new types of data such as NRIC, health data or CCTV footage. PDPC says risks are best addressed at the design stage, when changes cost less.
PDPC's guide gives an example: score likelihood and impact each from 1 to 5, multiply them to get a rating from 1 to 25, and treat ratings of 15 or more as immediate priorities. You can use your own scale, but define it in writing and use it consistently across projects.
The person accountable for the project, usually the owner or a director, together with the Data Protection Officer. PDPC's guide describes management approving the risk framework and the action plan. Record the date and any risks you have decided to accept, with the reason.
If the tool will process personal data, such as customer messages, recordings or files, a short DPIA is sensible. Check where data is stored, whether the vendor trains on it, how long it is kept and whether customers are told. AI tools change features often, so review the assessment regularly.