Singapore PDPA: What Overseas Businesses Need to Know

Scope and the obligations that differ

The Act applies to organisations collecting, using or disclosing personal data in Singapore, including those with no local incorporation. Public agencies are covered separately, and there are exclusions for individuals acting in a personal capacity and for business contact information used for business purposes, which is a genuinely useful carve-out with no direct GDPR equivalent.

The core obligations will feel familiar: consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation and accountability. Consent can be express or, in defined circumstances, deemed, which is more flexible than GDPR consent and closer in practice to a legitimate interests analysis.

The Do Not Call provisions sit alongside the data protection ones and catch out marketing teams. Checking the registry before sending marketing messages to Singapore numbers is a separate compliance obligation with its own penalties.

The DPO requirement is not optional

Every organisation must designate at least one individual as Data Protection Officer, and the business contact information for that role must be made publicly available. This is stricter than GDPR, where a DPO is required only in defined circumstances and publication is about notifying the supervisory authority rather than the world.

The role can be held by an existing employee and can be outsourced, and it does not require the independence protections GDPR attaches to the position. What it does require is that someone is genuinely reachable, because the regulator treats an unreachable DPO as an accountability failure in itself.

Breach notification

A breach is notifiable if it results in or is likely to result in significant harm to affected individuals, or if it is of a significant scale. Where notification is required, the regulator must be told within three calendar days of determining that the breach is notifiable, and affected individuals must be told as soon as practicable where significant harm is likely.

Three calendar days is a tighter operational constraint than it looks, because the clock starts on determination rather than discovery and there is an expectation that assessment happens promptly. A breach process built solely around the GDPR 72-hour rule will usually work, but the trigger and the counting differ enough to be worth writing down separately.

Penalties can reach a percentage of annual turnover in Singapore for larger organisations, or a fixed cap for smaller ones, whichever is higher. The regulator publishes enforcement decisions, which are worth reading because they are unusually specific about what adequate security looked like in each case.

What transfers from a GDPR programme

Most of it. Your data inventory, purpose and retention analysis, access and correction workflows, processor contracts and security controls carry across in substance. Transfer limitation works on a comparable standard of protection test rather than an adequacy list, which is usually satisfied by contractual measures you already have.

What needs specific attention is the DPO designation and publication, the breach determination and three-day notification path, Do Not Call registry checks if you market by phone or SMS, and the deemed consent analysis, which can simplify things if you use it deliberately rather than defaulting to express consent everywhere.