In this guide · 7 sections
Short answer
In Singapore you need an SPF Private Investigation Agency licence before you even advertise investigation services, so a website must not go live before the licence is granted. Once licensed, use a short confidential enquiry form, encrypted file exchange and strict access controls on case data.
Licensing points that affect your website
SPF's Apply for Private Investigation Agency Licence page (updated 14 September 2026) says a licence is required if your agency supplies the services of private investigators for reward, or advertises, or in any way holds out, that it supplies or is willing to supply them. A website, Google Business Profile or social media page offering investigations is advertising.
| Requirement | What SPF lists | Website or marketing impact |
|---|---|---|
| Licence before advertising | Needed to advertise or hold out PI services | Keep the site offline or as a holding page until licensed |
| Licence term and fee | 3 years, S$812 (from 15 Sep 2025), new or renewal | Note your expiry; an expired licence means the site is advertising unlicensed |
| Entity criteria | ACRA-registered, S$50,000 paid-up capital, at least two directors or partners, all Singapore Citizens or PRs with PI licences | Name the licensed entity consistently on the site |
| No debt collection | Licensing conditions bar debt collection by the agency and its staff | Do not list debt recovery or collection services |
| Trained investigators | Investigators need the WSQ module on legal compliance unless exempted | Describe team qualifications accurately |
SPF also says it sends a Notice of Renewal two months before expiry, and asks agencies to apply at least a month before the licence expires. Processing takes about four to six weeks. Our guide for security agency websites covers the related rules for guarding companies.
What a PI agency website should include
Clients looking for an investigator are often anxious and worried about being found out. The site should answer their questions without asking them to reveal much.
- Who you are: the licensed entity name, UEN and office address. Our guide to UEN display on websites and invoices explains the ACRA rules.
- Services in plain words: matrimonial, background checks, corporate and insurance investigations, surveillance. Describe what you do, not what you promise to find.
- How the first contact works: who reads enquiries, how fast you reply, and that the first conversation is confidential.
- How you handle data: a short privacy notice explaining what you collect on the form and why.
- Discreet contact options: a form, a phone number and an email address on your own domain.
Avoid client reviews or endorsements that could identify past clients, and avoid case stories that reveal details about subjects. A clear, factual site builds more trust than dramatic claims.
Building a confidential enquiry form
The enquiry form is where most risk sits: it receives sensitive details from people who have not yet hired you, often about third parties.
Ask for the minimum
Name or alias, preferred contact method, a safe time to call, and the type of matter from a drop-down. Leave a short free-text box, with a note asking them not to include full details yet.
Do not ask for NRIC numbers
There is no need to collect NRIC numbers at enquiry stage. PDPC's NRIC advisory guidelines generally do not allow collecting NRIC numbers unless required by law or needed to verify identity to a high degree.
Deliver submissions securely
Send form results to a protected inbox with MFA, not to a personal Gmail. Avoid storing submissions in the website's database if the site does not need them.
Make the reply discreet
Let the person choose how to be contacted and whether you may leave messages. Use a neutral sender name and subject line.
Add spam and bot protection
Use a challenge or honeypot so the form is not abused, and rate-limit submissions.
Exchanging files and case updates securely
Photos, video, documents and reports should not travel as ordinary email attachments. Plan one secure channel and use it for every case.
Safer options
- Client portal or shared folder with per-client access and MFA
- Links that expire and require sign-in
- End-to-end encrypted messaging for urgent updates
- Reports as protected PDFs with a password sent through a different channel
Avoid for case material
- Large files sent through free file-transfer services
- Reports emailed to a client's work address
- Group chats that include people outside the case
- NRIC or date of birth as a file password
On passwords, PDPC and CSA's 2025 advisory, announced by MDDI, told private organisations to stop using NRIC numbers as default passwords for files sent by email. Agree a passphrase with the client at the first meeting instead.
Case data security and the PDPA
Case files typically include the client's details, the subject's details, photos and location data. The PDPA's protection and retention obligations apply to the personal data you hold. Some PDPA exceptions to consent cover data needed for an investigation or proceedings, as defined in the Act, but you must still protect what you hold. This is general information, not legal advice; confirm your position with a lawyer.
Case data security checklist
Our website cost guide helps you budget for the site itself.
Do it yourself or get help?
A simple, factual site with a secure form is within reach of a template builder if someone on the team is careful with settings. The risk is in the details: where form data goes, who can read it, and whether old submissions pile up.
Our Business Website (S$1,490) builds up to six pages with a contact form and on-page SEO, designed to your brand and editable by you. Our Security Health Check (S$290) reviews your domain, website, email and workspace settings, including MFA and admin roles, with a plain-English report ranked by risk. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page.
Frequently asked questions
SPF's licence page says a Private Investigation Agency licence is required if a business advertises or in any way holds out that it supplies, or is willing to supply, private investigators for reward. A website offering investigation services is advertising, so keep it offline or as a neutral holding page until the licence is granted.
From 15 September 2025, SPF issues private investigation agency licences for three years at a fee of S$812, for both new and renewal applications. SPF sends a renewal notice two months before expiry and asks agencies to apply at least one month before the licence expires.
No. SPF's licensing conditions for private investigation agencies state that the licensee shall not be involved in any debt collection business and shall not authorise any employee to engage in debt collection. Do not list debt recovery among your services on the website or in ads.
No. There is no need for an NRIC number at enquiry stage, and PDPC's guidelines generally do not allow collecting NRIC numbers unless the law requires it or identity must be verified to a high degree of fidelity. Ask for a name, contact method and a brief description only.
Use one secure channel: a client portal or shared folder with sign-in and MFA, or expiring links that require login. If you send a protected PDF, share the password through a different channel and do not use NRIC numbers or dates of birth as passwords.