Singapore PDPA Compliance

Overview

Singapore's Personal Data Protection Act 2012 (PDPA, No. 26 of 2012) was enacted on 15 October 2012 and took effect in phases, with the main data protection provisions effective from 2 July 2014. Significant amendments in 2020 (effective 1 February 2021) introduced mandatory breach notification, deemed consent by notification, a data portability obligation, and enhanced enforcement powers.

The Personal Data Protection Commission (PDPC) is the regulatory authority, operating under the Infocomm Media Development Authority (IMDA). The PDPC issues Advisory Guidelines that provide detailed interpretation of the PDPA.

Key PDPA Obligations (Nine Obligations)

The Nine Obligations Framework