Quick answer: the PDPA checklist in one list
The Personal Data Protection Act 2012 (PDPA) applies to every private organisation in Singapore that collects, uses or discloses personal data. The PDPC says plainly that this includes small businesses, regardless of size. For a typical SME, compliance comes down to ten practical items:
- Appoint a Data Protection Officer (DPO) and publish their business contact details.
- Write a data protection policy for staff, and a privacy notice for customers.
- Tell people why you collect their data, and get consent where you need it.
- Keep a data inventory: what you collect, where it is stored and who can see it.
- Handle access and correction requests within a reasonable time.
- Set retention periods and delete data you no longer need.
- Protect the data with sensible security: MFA, access control, encryption and backups.
- Have a data breach plan that meets the PDPC's notification timelines.
- Check the Do Not Call (DNC) Registry before sending marketing calls, SMS or WhatsApp messages to Singapore numbers.
- Check your vendors (cloud apps, agencies, IT providers) and put data protection terms in your contracts.
Each item is explained below. This is general information, not legal advice. If you handle sensitive data (health, financial, children's data) or you are unsure how the law applies to you, speak to a lawyer.
Does the PDPA apply to your business?
Almost certainly, yes. The PDPA covers personal data about customers, staff, job applicants and contacts at other companies. Sole proprietors, partnerships, companies, societies and charities are all organisations under the Act. The main carve-outs are public agencies and individuals acting in a personal or domestic capacity.
The PDPA also includes the Do Not Call provisions, which apply to anyone sending marketing messages to Singapore phone numbers, even if you never store the numbers yourself.
The PDPC groups the main duties into named obligations: Consent, Purpose Limitation, Notification, Access and Correction, Accuracy, Protection, Retention Limitation, Transfer Limitation, Data Breach Notification and Accountability. You do not need to memorise them. The checklist below maps to them in everyday terms.
Penalties are real. Since 1 October 2022, the PDPC can impose a financial penalty of up to 10% of an organisation's annual Singapore turnover if that turnover exceeds S$10 million, or up to S$1 million otherwise. See the PDPC announcement.
The 10-point PDPA compliance checklist, explained
1. Appoint a DPO and register them with the PDPC
Every organisation must designate at least one person to be responsible for PDPA compliance, and make that person's business contact information available to the public. The DPO can be the owner, a staff member or an outside provider. Since 1 December 2024, DPO details are registered through the PDPC's online form using Corppass, not through ACRA BizFile+ (ACRA notice). Our DPO guide walks through the steps.
2. Write your policies
You need two documents. A data protection policy is internal: it tells staff how to handle personal data, who to ask and what to do if something goes wrong. A privacy notice (often called a privacy policy) is public: it tells customers what you collect, why, who you share it with and how to contact your DPO. The PDPC offers a free Data Protection Notice Generator that produces a basic notice.
3. Notification and consent
Tell people the purpose before or when you collect their data, for example with a line under your contact form or on your booking page. Get consent for anything a reasonable person would not expect, such as adding them to a marketing list. Let people withdraw consent and act on it. Keep a record of when and how consent was given.
4. Build a data inventory
List every place personal data lives: your website forms, email, WhatsApp, Google Drive or OneDrive, your accounting software, your booking or CRM tool, paper files and staff phones. For each, note what data is held, why, who has access and how long you keep it. A spreadsheet is fine. This one document makes every other item on the checklist easier.
5. Access and correction requests
Individuals can ask what personal data you hold about them and how it has been used in the past year, and ask you to correct it. Decide who handles these requests (usually the DPO), how you verify the requester's identity and how you log the response.
6. Retention: delete what you no longer need
Set a retention period for each type of data in your inventory, based on business or legal need. For example, keep accounting records for as long as tax rules require, but delete unsuccessful job applications after a set period. Put a recurring reminder in your calendar to do the clean-up.
7. Protect the data
The Protection Obligation asks for reasonable security arrangements. For a small office, that usually means:
- Multi-factor authentication (MFA) on email, cloud storage and admin accounts.
- Staff only see the folders and systems they need, and access is removed the day someone leaves.
- Laptops and phones are encrypted and screen-locked, and software updates are switched on.
- Passwords are kept in a password manager, not in a spreadsheet or WhatsApp group.
- Backups exist, are stored separately and have been test-restored.
- Your website uses HTTPS and your email domain has SPF, DKIM and DMARC.
You can check the last item for free with our domain and email check.
8. Have a data breach plan
If a breach happens, you must assess whether it is notifiable. Under the PDPC's breach guide, a breach is notifiable if it is likely to cause significant harm to individuals, or if it involves the personal data of 500 or more people. You should complete the assessment within 30 calendar days, and once you decide it is notifiable you must tell the PDPC as soon as practicable and no later than 3 calendar days. If significant harm is likely, you must also tell the affected individuals. Write down who does what, in advance.
9. Check the Do Not Call Registry
Before you send a marketing call, SMS, fax or WhatsApp message to a Singapore number, check it against the DNC Registry, unless you have the person's clear and unambiguous consent in evidential form. Some messages are exempt, such as service reminders and messages to businesses. The PDPC's DNC guide for organisations explains the rules and exemptions.
10. Check your vendors and overseas transfers
If an agency, IT provider or cloud app processes personal data for you, you are still responsible for it. Use contracts with data protection clauses, and check where data is stored if it leaves Singapore. Most large cloud providers publish data processing terms you can accept in the admin console.
NRIC numbers: a common SME mistake
Many businesses still ask for full NRIC numbers at visitor registration, for lucky draws or on membership forms. Under the PDPC's Advisory Guidelines on NRIC numbers, in force since 1 September 2019, organisations should generally not collect NRIC numbers or copies of NRICs unless the law requires it or it is necessary to establish identity to a high degree of fidelity. The same applies to FIN, birth certificate and work permit numbers.
If you collect NRIC numbers today, ask whether you really need them. A phone number, email or a partial identifier is usually enough.
Doing it in an afternoon: a realistic plan
If you are a small team starting from nothing, this order works well:
- 30 minutes: decide who your DPO is, create a dpo@ alias and register the DPO with the PDPC.
- 60 minutes: build your data inventory in a spreadsheet, system by system.
- 45 minutes: generate a privacy notice with the PDPC tool, edit it to match your inventory and publish it on your website.
- 30 minutes: write a one-page data protection policy for staff and a one-page breach plan with names and phone numbers.
- 30 minutes: turn on MFA for every email account and review who can access shared drives.
- 15 minutes: put calendar reminders in for a yearly policy review and a retention clean-up.
Print the checklist from the first section, tick each item off as you go, and keep it with your policies. It is a simple way to show you took the obligations seriously.
Where PDPC's free resources help
The PDPC and IMDA publish a lot of free material. The most useful for small businesses are:
- Getting started as a DPO: the PDPC's starting page, with DPO registration and key resources.
- Data Protection Notice Generator: a basic privacy notice in a few minutes.
- PDPA Assessment Tool for Organisations (PATO): a free self-check of your practices.
- Data Protection Essentials (DPE): IMDA's programme to help SMEs put basic data protection in place.
- Data breach self-assessment: helps you decide if a breach is notifiable.
If you want formal recognition later, IMDA runs the Data Protection Trustmark certification. Most small businesses do not need it to comply.
Do it yourself or get help?
You can do everything on this checklist yourself with the free PDPC tools. DIY works well if you are a small team with simple data (contact forms, invoices, a mailing list) and you are comfortable editing your website.
Getting help makes sense when you are short on time, you hold sensitive data, or you need the paperwork to match how your systems are actually set up. Our PDPA Compliance Pack (S$690, fixed price) produces the privacy policy, data inventory, staff data protection policy, DPO appointment notes, breach response plan and cookie notice from a 20-minute online questionnaire. It is not legal advice and we do not act as your DPO. If you want a fuller plan for incidents beyond data breaches, see the Incident & Ransomware Response Plan (S$390).
If you are not sure how well your accounts are protected, a Security Health Check (S$290) gives you a ranked fix list you can work through yourself.
Frequently asked questions
The PDPC does not publish a single one-page checklist, but it offers free tools that cover the same ground: the DPO starting page, the Data Protection Notice Generator, the PDPA Assessment Tool for Organisations (PATO) and the data breach self-assessment. The ten points in this guide map to the PDPA's main obligations.
Yes. The PDPC states that the PDPA applies to all organisations in Singapore that handle personal data, regardless of size. A one-person business with a customer list still needs a DPO, a privacy notice and reasonable security.
If your website collects personal data, for example through a contact form, booking tool or newsletter sign-up, you need to tell people why you collect it and how to contact you. A privacy notice linked from every form is the simplest way to do that.
You should assess whether a breach is notifiable within 30 calendar days of becoming aware of it. Once you decide it is notifiable, you must notify the PDPC as soon as practicable and no later than 3 calendar days. A breach is notifiable if it is likely to cause significant harm or affects 500 or more individuals.
Marketing messages to Singapore numbers fall under the Do Not Call provisions. Check the DNC Registry first unless you have clear and unambiguous consent in evidential form, and remember that consent under the data protection rules is still needed to use the person's data for marketing.
No. This is general information to help small businesses get organised. For questions about your specific situation, consult a Singapore lawyer or refer to the PDPC's advisory guidelines.