StarLabs Glossary / Grants & Compliance Terms
PDPA (Personal Data Protection Act)
Singapore’s main law on how organisations collect, use, look after and dispose of personal data.
The PDPA is the Personal Data Protection Act 2012, Singapore’s general law on personal data held by private-sector organisations. It sets rules on consent, purpose, accuracy, security, retention, overseas transfers and breach reporting. It is administered by the Personal Data Protection Commission (PDPC), which can impose financial penalties for breaches.
Grant rules and laws change. Check the official page before you apply or act. This page is general information, not legal or financial advice.
How it works
Personal data is any data about a person who can be identified from it, such as a name with a phone number, an NRIC number, a photo or a customer record. If your business collects it from customers, staff or job applicants, the PDPA applies to you, whatever your size.
The PDPC groups the rules into data protection obligations. In plain terms:
| Obligation | What it asks of you |
|---|---|
| Accountability | Have data protection policies, designate a DPO and publish their business contact details. |
| Notification, Consent, Purpose Limitation | Tell people why you collect their data, get consent, and only use it for reasonable purposes they agreed to. |
| Accuracy | Make a reasonable effort to keep data correct and complete. |
| Protection | Make reasonable security arrangements against unauthorised access, use, disclosure and similar risks. |
| Retention Limitation | Stop keeping data, or dispose of it properly, once it is no longer needed. |
| Transfer Limitation | Only send data overseas where it gets comparable protection. |
| Access and Correction | Let people see and correct the data you hold about them. |
| Data Breach Notification | Assess breaches and report notifiable ones. See Mandatory Data Breach Notification. |
| Data Portability | PDPC says this takes effect when its regulations are issued. |
The Act also has Do Not Call rules for marketing messages sent to Singapore telephone numbers.
Penalties
Since 1 October 2022, the PDPC can impose a financial penalty of up to 10% of an organisation’s annual turnover in Singapore if that turnover is more than S$10 million. For other organisations the maximum is S$1 million. PDPC publishes its enforcement decisions, so a breach can also cost you reputation.
What it means for your business
Data incidents often start with everyday IT gaps: a shared admin password, an unencrypted laptop left in a taxi, a spreadsheet emailed to the wrong person, or an old PC sold with customer files still on it. The Protection and Retention Limitation obligations are where good IT habits matter most.
StarLabs does not give legal advice on PDPA. We can help with the IT measures that support the Protection obligation: access control and MFA, backups, device encryption, patching and secure disposal of old devices.
Common questions
Does the PDPA apply to small businesses?
Yes. The PDPA applies to organisations that collect, use or disclose personal data in Singapore, regardless of size. A two-person shop with a customer list is covered.
What is the maximum PDPA fine?
From 1 October 2022, up to 10% of annual turnover in Singapore for organisations whose local turnover exceeds S$10 million, or up to S$1 million otherwise.
What counts as “reasonable security arrangements”?
The PDPA does not list fixed tools. PDPC looks at what is reasonable for the data and risks involved. Common basics include access controls, strong passwords with MFA, encryption, updates and safe disposal.
Are your laptops and files locked down?
We set up access control, backups, encryption and patching for small offices.
Sources: PDPC: Data Protection Obligations, Allen & Gledhill: increased PDPA penalties from 1 October 2022, Personal Data Protection Act 2012 (Singapore Statutes Online)
Reviewed by the StarLabs technical team · Last checked 18 October 2026
← Grants & Compliance Terms · ← All terms · Common questions
