Website Privacy Policy and Cookie Consent Under the PDPA

Does your website need a privacy policy?

If the site collects any personal data, in practice yes. The PDPA's notification and consent obligations mean you must tell people the purposes for which you collect, use or disclose their personal data, and get their consent (or rely on an exception) before you do. A website privacy policy, linked from every page footer and next to each form, is the standard way to give that notice.

Common ways a small business website collects personal data:

• contact and enquiry forms (name, email, phone, message);
• booking and appointment tools;
• online store checkouts and customer accounts;
• newsletter sign-ups;
• WhatsApp chat buttons and live chat or AI assistants;
• analytics and advertising tools that track visitors with cookies.

Even a one-page site with a single form needs a short notice. The PDPC also offers a free notice generator to help you draft one.

What a website privacy policy should cover

• Who you are: your business name and how to contact you.
• What personal data you collect through the site, form by form.
• Why you collect it: answering enquiries, bookings, orders, sending newsletters (only if they opted in), improving the site.
• Who you share it with: your email provider, booking or payment platform, delivery partners, analytics and advertising providers.
• Transfers overseas, if your tools store data outside Singapore (most cloud tools do).
• Cookies and similar tracking: what you use, why, and how to change preferences.
• How long you keep data, or how you decide.
• How people can withdraw consent, access or correct their data.
• Your data protection officer's business contact details. See our guide to appointing a DPO.

Write it in plain English. A long policy copied from an overseas template that mentions laws and tools you don't use is worse than a short, accurate one.

Cookies: what the PDPC actually says

The PDPC's Advisory Guidelines on the PDPA for Selected Topics (revised May 2024) set out a balanced approach:

• The PDPA applies to the collection, use or disclosure of personal data using cookies.
• Not all cookies collect personal data. Consent is not needed for cookies that don't.
• For activities the user has clearly requested, consent may not be needed where they know the purpose and voluntarily provided the data, for example storing what they type into a web form to complete a purchase, or cookies needed for authentication, security, preferences or streaming.
• Consent may be reflected in browser settings: if someone sets their browser to accept some cookies and reject others, they may be taken to have consented to the cookies they accepted.
• Targeted advertising that collects and uses personal data through cookies requires the individual's consent. As good practice, the PDPC says websites should let people set cookie preferences to enable or disable cookies used for personalised ad targeting.
• Where a third party uses cookies on your site to collect personal data and you are not collecting it yourself, the obligation to obtain consent is on that third party.

Which cookies need consent? A practical table

If you also have many visitors from the EU or UK, their rules (GDPR and the e-privacy rules) are stricter about prior consent for non-essential cookies. Many businesses simply use a banner that blocks ad and analytics cookies until the visitor accepts.

Forms, newsletters and WhatsApp: the details people miss

• Collect only what you need. A contact form rarely needs a date of birth, and almost never an NRIC number. Our guide to NRIC collection rules explains why.
• Marketing needs its own consent. Don't pre-tick a newsletter box or add every enquiry to your mailing list.
• Check the Do Not Call Registry before sending marketing messages to Singapore phone numbers by call, SMS or WhatsApp, unless you have clear consent. See the PDPC's Do Not Call guide for organisations.
• Secure the form. HTTPS on every page, spam protection, and form emails delivered to an account with MFA.
• Clear out old data. Delete enquiries you no longer need, in your inbox, form plugin and CRM.

Setting it up, step by step

1. List every form, tool and script on your site, and what personal data each one collects.
2. Remove anything you don't need: old pixels, unused plugins, extra form fields.
3. Draft the privacy policy using the list above (the PDPC notice generator helps), and have someone check it matches what the site really does.
4. Publish it at /privacy and link it from the footer and beside every form.
5. Add a cookie notice. If you use advertising pixels, use a banner with a preferences option that can switch them off.
6. Add the short notice under each form, and a separate, unticked opt-in for marketing.
7. Set a reminder to review the policy whenever you add a new tool, and at least once a year.

Our PDPA checklist for small businesses covers the obligations beyond the website.

Do it yourself or get help?

A simple brochure site with one contact form and no ad pixels can be covered with the PDPC notice generator and an afternoon's work.

The PDPA Compliance Pack (S$690) includes a website privacy policy, a cookie and consent notice, a personal data inventory, a staff data protection policy, DPO appointment notes and a breach response plan, from a 20-minute online questionnaire. We are not a law firm, so this is practical compliance work, not legal advice. If you only need the notice and banner added to your site, a Quick Fix (S$119, one hour) is often enough.