Loading...
Personal Data Protection Act 2012 (as amended 2020)
Singapore's Personal Data Protection Act establishes 10 data protection obligations for all private sector organisations. The 2020 amendments introduced mandatory data breach notification, expanded deemed consent, data portability, enhanced financial penalties, and a private right of action. The PDPC actively enforces the law with a growing track record of enforcement decisions.
10
Data Protection Obligations
30d
Breach Notification Window
SGD 1M
Max Fine (or 10% turnover)
Oct 2022
Enhanced Penalties
1 July 2014
Original PDPA became effective
2 November 2020
Parliament passed PDPA Amendment Act 2020
1 February 2021
Major amendment provisions in force, including breach notification
1 October 2022
Enhanced financial penalty caps in effect
Obtain clear, unambiguous consent before collecting, using, or disclosing personal data, with deemed consent provisions for specified contexts.
Use data only for stated purposes, notify PDPC within 30 days and affected individuals of significant data breaches.
Maintain accurate personal data, implement reasonable physical, technical, and organisational security measures.
Retain data only as long as necessary, ensure overseas transfers meet PDPA equivalent protection standards.
Provide individuals right to access and correct personal data, appoint a Data Protection Officer for organisational compliance.
SGD 1M or 10% Singapore turnover
Whichever is higher; applies to organisations with SGD 10M+ turnover
SGD 1M or 5% Singapore turnover
Applies to organisations with SGD 20M+ turnover
PDPC directions and financial penalties
Warnings, directions to comply, financial penalties, prosecutions
We provide structured preparation and compliance support for SG PDPA.
Schedule a consultation with our regulatory experts to assess your SG PDPA compliance posture and build a practical roadmap.