In this guide · 8 sections
Short answer
GDPR applies to a Singapore business that offers goods or services to people in the EU or monitors their behaviour there. If it does, add a documented lawful basis for each use of data, prior consent for non-essential cookies, an EU representative in most cases, and a 72-hour breach notification process.
Does GDPR apply to my Singapore business?
Article 3 of the GDPR sets its territorial scope. It applies to businesses established in the EU, and also to businesses outside the EU that process personal data of people in the EU where the processing relates to either of two things:
- Offering goods or services to people in the EU, whether or not they pay.
- Monitoring their behaviour in the EU, for example tracking for targeted advertising or profiling.
A website that EU residents can simply reach is not enough on its own. Signs that you are offering to the EU include pricing in euros, shipping to EU countries, EU language versions or marketing aimed at EU customers. If you run ad pixels and retargeting on EU visitors, the monitoring limb may apply even without sales.
If you only sell to Singapore businesses and occasionally get an EU visitor, GDPR is unlikely to apply. If a meaningful share of customers are in the EU, assume it does and plan accordingly.
PDPA vs GDPR side by side
The table compares the points that most often trip up Singapore SMEs. PDPA references are to the Personal Data Protection Act 2012 and PDPC guidance.
| Topic | PDPA (Singapore) | GDPR (EU) |
|---|---|---|
| Basis for using data | Consent (including deemed consent) or an exception such as legitimate interests | One of six lawful bases in Article 6: consent, contract, legal obligation, vital interests, public task, legitimate interests |
| Data protection officer | Every organisation must designate one | Required only in specific cases (Article 37), such as large-scale monitoring |
| Local presence | None required for overseas firms | Non-EU firms under Article 3(2) usually need an EU representative (Article 27) |
| Breach notification | Assess within 30 days; notify PDPC within 3 calendar days if notifiable | Notify the supervisory authority without undue delay, within 72 hours where feasible (Article 33) |
| Maximum fine | S$1 million or 10% of Singapore turnover (if over S$10 million) | EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Article 83) |
Our PDPA checklist covers the Singapore baseline in full. The rest of this guide focuses on what GDPR adds.
Lawful basis: the biggest mindset change
Under the PDPA, the starting question is usually 'do we have consent, or does an exception apply?'. Under GDPR, you must identify and record a lawful basis for each purpose before you start, and tell people what it is in your privacy notice.
- Contract: processing an order, delivering a service or answering a quote request the person asked for.
- Legal obligation: keeping invoices for tax law.
- Legitimate interests: fraud prevention, basic analytics or direct marketing to existing customers, after balancing your interest against the person's rights.
- Consent: for things like marketing emails to new contacts or non-essential tracking. GDPR consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give.
In practice, most SMEs rely on contract for orders, legal obligation for records, and consent or legitimate interests for marketing. Write the mapping down; it becomes the backbone of your privacy notice and records.
EU representative, rights requests and records
Representative. Article 27 requires a non-EU controller covered by Article 3(2) to designate a representative in the EU in writing. There is an exemption for processing that is occasional, does not involve large-scale sensitive data or criminal records, and is unlikely to create risk. Regular online sales to EU consumers usually do not fit that exemption. Commercial representative services exist for this.
Rights. Both laws give access and correction rights. GDPR adds rights to erasure, restriction, objection and data portability, and generally requires a reply within one month. Build one process that handles both. Our guide to responding to PDPA access requests is a good base.
Records and contracts. GDPR expects records of processing activities in many cases, and Article 28 contracts with processors such as email, hosting and CRM vendors. If you already keep a PDPA data inventory and vendor list, extend it rather than starting again.
Breach notification under both laws
A single incident may trigger both regimes, with different clocks. Plan for the faster one.
Contain and start a record
Note when you became aware, what happened and whose data is affected, including EU residents.
Assess GDPR risk immediately
Unless the breach is unlikely to result in a risk to people, notify the relevant EU supervisory authority within 72 hours of becoming aware, where feasible.
Assess PDPA notifiability
A breach is notifiable if it is likely to cause significant harm or affects 500 or more people. Notify the PDPC within 3 calendar days of deciding.
Tell affected individuals
Under GDPR where there is high risk; under the PDPA where significant harm is likely.
Review and record lessons
Both regulators expect documentation of what you did and why.
Our guide to PDPA data breach notification covers the Singapore side step by step.
Do it yourself or get help?
If GDPR clearly applies, the extra work is mostly documentation: a lawful-basis map, an updated privacy notice, a stricter cookie banner, processor contracts, an EU representative, and a breach process with a 72-hour clock. A lawyer familiar with both regimes is worth consulting for the representative and contract questions.
Our PDPA Compliance Pack (S$690) builds the Singapore foundation: data inventory, policies, privacy notice, consent wording and breach procedure. Those documents are the natural starting point for GDPR additions. This guide is general information, not legal advice.
Frequently asked questions
It can. Under Article 3(2), GDPR applies to non-EU businesses that process personal data of people in the EU when offering them goods or services, paid or free, or when monitoring their behaviour in the EU. A website merely reachable from the EU is not enough; targeting EU customers or tracking EU visitors is.
Not automatically. The principles overlap, but GDPR adds a documented lawful basis for each purpose, stricter cookie consent, an EU representative in most cases, extra rights such as erasure and portability, processor contract terms, and a 72-hour breach notification deadline. A PDPA programme is a good base to build on.
Usually, if GDPR applies to you through Article 3(2). Article 27 exempts processing that is occasional, does not include large-scale processing of sensitive or criminal data, and is unlikely to create risk. A business regularly selling to EU consumers typically does not meet that exemption.
Under GDPR, notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware, unless the breach is unlikely to create risk. Under the PDPA, assess within 30 days and notify the PDPC within 3 calendar days of determining the breach is notifiable.
The maximums are. GDPR fines for the most serious breaches can reach EUR 20 million or 4% of worldwide annual turnover, whichever is higher. PDPA penalties can reach S$1 million or 10% of annual Singapore turnover for organisations with turnover above S$10 million, whichever is higher.