Singapore's PDPA: What Website Owners Need to Know

Singapore's Personal Data Protection Act, known as the PDPA, governs how organisations collect, use and disclose personal data. It is administered by the Personal Data Protection Commission. This is a plain-English overview for website owners, not legal advice.

The core obligations

The PDPA is built around a set of obligations: get consent for collecting and using personal data, tell people the purpose, use it only for that purpose, keep it accurate and secure, and let people access and correct their data. There is also an accountability obligation to have policies in place and a data protection officer.

For a website, that means a clear privacy policy, honest consent at the point of collection, and proper security.

Appoint a data protection officer

The PDPA requires organisations to designate at least one data protection officer responsible for ensuring compliance, and to make a business contact for them available. For a small business this can be an existing staff member, but the role needs to genuinely exist and be reachable.

Publishing a privacy contact on your website is part of meeting this.

Breach notification

Mandatory data breach notification applies. If a breach is likely to result in significant harm to individuals, or is of significant scale, you must notify the Commission, and affected individuals where required, within the timeframes set out in the law.

Keep a simple record of what data you hold so you can assess and report quickly if needed.

What a typical site needs

• A clear privacy policy covering collection, use, disclosure and retention.
• Genuine consent at the point you collect data.
• A named data protection officer with a contact point.
• SSL across the site and sound security practices.
• A process for access, correction and breach handling.