Singapore. Comprehensive data protection. Act
PDPA (Singapore)Personal Data Protection Act 2012
In force
§1Summary
- Synopsis
Singapore's private-sector privacy law based on consent, purpose limitation and reasonableness, with accountability and breach-notification duties. It also houses the national Do Not Call regime.
- Key themes
- Unique features
Mandatory DPO for every organisation; 500-person threshold for breach notification; data intermediaries (processors) carry only protection, retention and breach duties.
- SaaS relevance
Applies to organisations collecting data in Singapore; SaaS acting as data intermediaries must secure data and notify clients of breaches without undue delay.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- PDPC within 3 calendar days of assessing a notifiable breach (significant harm or ≥500 individuals); individuals if significant harm
- DPO
- Yes
- Cross-border transfers
- Comparable protection via contracts, BCRs, consent or certifications (APEC CBPR/PRP)
- Maximum penalty
- 10% of Singapore annual turnover (if >S$10m) or S$1m
§3Dates
- Key dates
- Adopted
- In force
- Amendment Act 2020 phased from 2021-02-01 (breach notification, deemed consent, legitimate interests); higher penalty cap from 2022-10-01; data portability not yet commenced
§4Text and authority
- Text
- Authoritative text sso.agc.gov.sg
- Authority
- Personal Data Protection Commission (PDPC)
§5Where it applies
- Domestic law of
- Singapore
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Penalty and phase dates for 2020 amendments partly from general knowledge. NRIC-for-authentication phase-out by 2026-12-31.