PDPA Training for Employees: What Staff Need to Know

Do employees need PDPA training?

The PDPA does not list a training course you must buy, but it does require organisations to protect personal data and to be able to show how they meet their obligations. The PDPC's Guide to Data Protection Practices for ICT Systems says organisations should communicate their data protection policies to staff and build a culture of responsibility through regular training and awareness programmes.

In practice, staff are where most data handling happens: the receptionist who photocopies an NRIC, the salesperson who exports a customer list, the HR executive who emails payslips. If they do not know the rules, your policies stay on paper. The PDPC's new programme opens with the same point: protecting personal data is everyone's job, not the DPO's alone.

This page is general information, not legal advice. If you are still setting up the basics, start with our PDPA checklist for small businesses.

The free PDPC e-learning programme, explained

The PDPC published its e-Learning Programme for Every Employee on 1 September 2026. It is free and split into two short series of videos, each about 4 to 7 minutes long.

Series 1 ends with a multiple-choice assessment of up to 30 minutes. No login is needed: staff enter their email and the results are sent to them. The PDPC says there is no prescribed passing score, so the DPO can set one. Each Series 2 section has its own six-question assessment.

Role-based topics to add for your own staff

The PDPC videos teach the rules. What they cannot teach is how your forms, systems and habits work. Add a short internal session per role, built around real tasks in your business:

• Front desk and reception: what ID details you may record, why you should not photocopy NRICs by default, visitor logs, CCTV signs, handing over documents only to the right person.
• Sales and marketing: where consent is recorded in your CRM, checking the DNC Registry before calls or messages to Singapore numbers, never exporting full customer lists to personal devices.
• HR and managers: which staff records are kept, who can see them, how long you keep job applicant data, sending payslips and medical documents safely.
• Customer service: verifying identity before discussing an account, logging access and correction requests, when to pass a request to the DPO.
• Everyone who uses email or shared drives: checking recipients, password-protecting or link-sharing files correctly, and reporting mistakes immediately.

Keep it practical. A 20-minute walk-through of your own booking form or CRM, with one or two examples of what went wrong elsewhere, sticks far better than slides about legal definitions.

The everyday mistakes that cause most breaches

Training should focus on the mistakes people actually make. Two PDPC resources are useful here. The Guide to Preventing Accidental Disclosure covers measures to stop personal data being sent to the wrong recipients. The PDPC's handbook on common types of data breaches identifies five recurring gaps from past cases: coding issues, configuration issues, malware and phishing, security and responsibility issues, and accounts and passwords.

Make it safe to own up. Under the PDPA, once an organisation assesses that a breach is notifiable, it must notify the PDPC within 3 calendar days. That clock depends on staff reporting incidents quickly. Our data breach notification guide explains the full process.

How to run PDPA training in a small business

You do not need a learning management system. A simple, repeatable routine works for a team of 5 to 50:

1. 1

   Pick the PDPC sections for each role

   Everyone watches Series 1 (Sections 1 to 6). Map each role to the relevant Series 2 sections, for example HR to Section 8 and front desk to Section 11.

2. 2

   Set a deadline and a pass mark

   Give staff two weeks to watch and complete the assessments. Decide your own pass mark, since the PDPC does not set one.

3. 3

   Run a 20-minute internal session

   Walk through your own forms, systems and data protection policy, and who the DPO is.

4. 4

   Collect proof of completion

   Ask staff to forward their result emails, or have the DPO request the assessment records from the PDPC.

5. 5

   Add it to onboarding

   New joiners complete Series 1 and the internal session in their first week, before getting access to customer data.

6. 6

   Repeat yearly and after incidents

   Re-run training at least once a year, and give a short refresher whenever a near miss or breach happens.

Keeping records of PDPA training

If the PDPC ever looks at a breach, being able to show that staff were trained, and what they were told, helps demonstrate accountability. A spreadsheet is enough:

Store the record with your other PDPA documents, and keep it up to date when people join or leave.

Do it yourself or get help?

Most small businesses can run this themselves: the PDPC programme is free, and the internal session can be written in an afternoon once your policies exist. What usually takes longer is the paperwork the training points back to: a data protection policy, a privacy notice and a breach plan staff can follow.

Our PDPA Compliance Pack (S$690) prepares those documents, including a staff data protection policy and breach response plan. For ongoing scam and phishing awareness alongside PDPA, Security Awareness Training (S$390) sets up short monthly lessons with completion tracking in your own account. We are not a law firm and do not act as your DPO.