PDPA (Personal Data Protection Act)

Last reviewed: August 2026

Overview

The PDPA (Personal Data Protection Act) is Singapore’s general personal data protection law, enacted in 2012. The Personal Data Protection Commission (PDPC) serves as the enforcement authority; under the law, the Infocomm Media Development Authority (IMDA) is designated as the PDPC and performs the personal data protection function.

The PDPA sets out obligations including Consent, Purpose Limitation, Notification, Access & Correction, Accuracy, Protection, Retention Limitation, the Transfer Limitation Obligation, Accountability, and Breach Notification. The Data Portability Obligation (Part 6B), introduced by a 2020 amendment, has not yet taken effect because its implementing regulations have not been issued, so it is not currently a compliance obligation.

Note

The threshold for breach notification is met if either of the following applies: (1) the breach results in, or is likely to result in, significant harm to affected individuals (financial loss, identity theft, physical harm, reputational damage, etc.), or (2) the number of affected individuals is 500 or more. The PDPC advises that it expects notification within three days (calendar days, not business days) of completing the assessment.

For violations, the PDPC may impose a financial penalty of up to S$1 million, or, for organizations with annual turnover in Singapore exceeding S$10 million, 10% of their annual turnover in Singapore, whichever is higher.

Transfer Limitation Obligation

The Transfer Limitation Obligation, set out in Part 4 of the PDPA, prohibits an organization from transferring personal data outside Singapore unless it takes appropriate steps to ensure that the recipient will provide a standard of protection comparable to the PDPA. In other words, the core principle is “comparable protection” — the same level of protection as the original must be maintained even once the data crosses a border.

The transfer mechanisms traditionally recognized include:

• The individual’s consent to the transfer
• Contractual clauses
• Binding Corporate Rules (BCRs)
• Statutory exceptions, such as transfers necessary to perform a contract with the individual
• Transfer to a country or territory that the Minister has prescribed as providing a standard of protection comparable to the PDPA

April 2026 Guide Revision — Streamlining the CBPR/PRP Certification Pathway

On April 14, 2026, the PDPC issued a revised guide on cross-border data transfers. This reflects the regulator’s expectations in line with the concurrently effective PDPA Amendment Regulations 2026, and its key feature is a reorganization of the full set of recognized transfer mechanisms to align with the latest regulations. The CBPR/PRP certification pathway itself has already existed since it was first recognized in June 2020 and reflected in regulations in February 2021, and this revision reorganizes the overall framework, including that pathway.

• A recipient organization (acting as a controller) holding APEC CBPR (Cross-Border Privacy Rules) certification is deemed to satisfy the Transfer Limitation Obligation.
• A recipient organization (acting as a data intermediary) holding APEC PRP (Privacy Recognition for Processors) certification is likewise deemed to satisfy the requirement. A data intermediary need hold either CBPR or PRP, or both.
• Instead of negotiating and reviewing individual contracts (similar to SCC-style clauses) for every transaction, a route where certification alone establishes the legal basis for a cross-border transfer is clearly laid out.

Caution

CBPR and PRP are certification schemes recognized only among APEC member economies. Where the destination country or company does not participate in the APEC CBPR/PRP certification system, existing mechanisms such as contractual clauses or BCRs still need to be used. Major economies including the US, Korea, and Japan participate in the APEC CBPR system, so it is worth evaluating the practical benefit of this certification route when designing cross-border data transfers with these jurisdictions.

Practical Implications for ASEAN Region Design

• Singapore takes an open transfer policy. Unlike neighboring countries such as Indonesia and Vietnam, which are strengthening data localization (mandatory domestic storage), Singapore maintains a principles-based approach of “transfers are permitted once comparable protection is confirmed.” It is therefore worth using Singapore as an ASEAN data hub while separately verifying the localization rules of each individual market you enter.
• Determine the transfer mechanism up front when designing region architecture. If you operate a multi-region structure where data moves between a headquarters, a Singapore region, and third-country affiliates, deciding in advance — at the data-flow-diagram stage — which mechanism (contractual clauses, CBPR/PRP certification, or consent) applies to each leg makes audit response far easier.
• Review a certification roadmap early. CBPR/PRP are not self-certifications; they require assessment by an APEC-accredited Accountability Agent, so obtaining them takes considerable lead time. If you plan to expand into multiple ASEAN markets, it is advantageous to pursue certification early alongside a contract-based approach.
• The PDPA has extraterritorial reach. A foreign company that is not based in Singapore but collects or processes the personal data of individuals in Singapore (for example, a SaaS offering targeted at Singapore customers) can still be subject to the PDPA, so it should not be assumed that simply “not placing a region in Singapore” removes you from its scope.

Practical Considerations: DNC (Do Not Call) and More

Separate from its personal-data-processing obligations, the PDPA includes DNC (Do Not Call) provisions. Individuals can register their Singapore telephone number with one or more of three registers to opt out of certain types of marketing contact.

• No Voice Call Register
• No Text Message Register
• No Fax Message Register

Before sending marketing voice calls, text messages, or faxes to a Singapore telephone number (mobile, fixed-line, residential, or business), an organization must check the DNC registers to confirm whether the recipient is registered — unless it has obtained explicit consent or an exemption/exclusion under the PDPA applies. Contacting a registered number can be treated as a violation and reported to the PDPC.

Note

The DNC check obligation is a practical item frequently overlooked by foreign companies (especially in e-commerce, fintech, and SaaS) that run marketing channels targeting Singapore customers — B2C marketing campaigns, outbound call centers, and SMS-based promotions in particular. It is advisable to integrate a DNC check step into CRM and marketing automation pipelines.

Demonstrating Accountability — DPTM (Data Protection Trustmark) Certification

DPTM (Data Protection Trustmark), jointly developed by the PDPC and IMDA, is a voluntary certification scheme under which a third party verifies an organization’s level of PDPA compliance and the maturity of its personal data governance. In 2025 it was incorporated into Singapore Standard SS 714:2025, reinforcing its standing as a national standard.

• Although not a statutory requirement, certification allows an organization to demonstrate its governance, accountability, and customer-response framework externally, and it often serves as a credit factor in B2B contracting or government-procurement vendor due diligence.
• A foreign company with a local subsidiary in Singapore that operates consumer-facing services may consider obtaining DPTM as one way of fulfilling the PDPA’s Accountability obligation.
• Certification is performed by certifying bodies accredited by the PDPC and IMDA, and organizations may choose to scope it enterprise-wide or to a specific business unit.

References

• Individual’s Guide to the Do Not Call (DNC) Registry — PDPC
• Organisation’s Guide to Singapore’s Do Not Call (DNC) Provisions — PDPC
• The Transfer Limitation Obligation — PDPC
• Data Protection Trustmark (DPTM) Certification — IMDA
• Accountability Within Industry — PDPC
• Fintech Singapore: PDPA Cross-border Data Transfers (2026) — Global Law Experts
• Data Protection & Privacy 2026 - Singapore — Chambers and Partners
• Data Protection Laws and Regulations 2026 | Singapore — ICLG