PDPA compliance basics for Singapore SMEs

Does the PDPA apply to my business?

If your business holds a customer database, a mailing list, staff records, supplier contacts, or even just names and phone numbers collected through a website form, the PDPA applies to you. It governs how organisations collect, use, disclose, and protect the personal data of individuals in Singapore, and it sits alongside — not instead of — any sector-specific rules your business may already follow (for example, banking secrecy or healthcare regulations).

The Act is enforced by the Personal Data Protection Commission (PDPC), and its obligations apply regardless of company size. A five-person accounting firm or a family-run retail business has the same underlying obligations as a large enterprise — what differs is how proportionate the compliance programme needs to be.

The core obligations, at a glance

The PDPA is built around a set of data protection obligations that apply throughout the lifecycle of personal data your business touches:

• Consent and purpose limitation — you generally need an individual's informed consent before collecting, using, or disclosing their data, and you may only use it for purposes a reasonable person would consider appropriate. Narrow exceptions exist for "legitimate interests" and "business improvement purposes," such as internal analytics.
• Notification — individuals must be told why their data is being collected, typically through a privacy policy or a collection notice at the point of interaction (a sign-up form, a job application, an invoice).
• Access and correction — individuals can ask for the personal data you hold on them and how it has been used or disclosed in the past year, and ask you to correct errors. Respond to access requests as soon as reasonably possible; if you cannot do so within 30 days, tell the individual when you will. You may charge a reasonable fee to cover the incremental cost of an access request, but you must give a written estimate first.
• Accuracy — data used to make a decision about an individual, or disclosed to another organisation, must be reasonably accurate and complete.
• Protection — reasonable security arrangements must be in place to prevent unauthorised access, collection, use, disclosure, or disposal of personal data. Many of the same internal controls that prevent fraud also protect data.
• Retention limitation — personal data cannot be kept longer than is necessary for the purpose it was collected for, or for legal or business reasons.
• Transfer limitation — if you transfer personal data outside Singapore (to an overseas payroll vendor or cloud CRM, for instance), the receiving party must provide a comparable standard of protection.
• Openness and accountability — you must be able to demonstrate compliance, which in practice means having a written data protection policy and designated personnel responsible for it.

Appointing a Data Protection Officer

Under Section 11(3) of the PDPA, every organisation must designate at least one Data Protection Officer (DPO), and their business contact information must be made available to the public. There is no exemption based on how little personal data the business handles.

The simplest way to publish those details is to register your DPO through ACRA’s BizFile+. Registration is voluntary, but it satisfies the requirement to make the DPO’s contact details available, and the PDPC strongly encourages it. Listing a DPO email address on your website and privacy policy also helps customers reach the right person.

For an SME, this does not need to be a dedicated, full-time hire. Many businesses appoint an existing staff member — someone in operations, HR, or finance — to take on the role alongside their regular duties, or engage an external compliance provider. In substance, the DPO is responsible for:

• Developing and maintaining the company's data protection policy, including consent and breach-response procedures.
• Handling access requests and data-related complaints from customers or staff.
• Assessing new systems or vendors for data protection risk before they go live.
• Training staff on basic data-handling practices.
• Keeping an eye on PDPC guidance and making sure the business's practices keep pace with it.

NRIC numbers: collect them only when you must

Since 1 September 2019, PDPC guidelines restrict organisations from collecting, using or disclosing NRIC numbers (and similar identifiers such as FIN and passport numbers) except where it is required under the law, or necessary to accurately establish or verify someone’s identity to a high degree of fidelity — for example, opening a bank account or checking in at a hotel. Recording visitor NRIC numbers at reception, or asking for them to sign up for a lucky draw or a loyalty programme, generally does not qualify.

The practical fix for most SMEs is to swap NRIC numbers for something else: a mobile number, an email address, or a membership number you issue. Where you do need NRIC details (for payroll and CPF, for instance, which is required by law), limit who can see them and avoid keeping photocopies of physical NRICs unless you genuinely need them. See our guide to hiring your first employee for the records you do need to keep for staff.

Marketing messages and the Do Not Call Registry

The PDPA also contains the Do Not Call (DNC) provisions, which apply to marketing calls, SMS and other text messages sent to Singapore telephone numbers. Before sending a marketing message, check the number against the DNC Registry, unless the person has given you clear and unambiguous consent to receive it, in a form you can produce later. Messages must also identify your business and give contact details. The maximum financial penalty for an organisation that breaches the DNC provisions is S$1 million, so marketing campaigns run by an agency on your behalf deserve the same care as your own.

Mandatory data breach notification

This is the obligation with the most immediate consequences if it's missed. A data breach is notifiable to the PDPC if it meets either of two tests:

• The significant harm test — the breach is likely to cause significant harm to affected individuals, for example where a full name is exposed together with financial information, health data, or an identifier such as a passport number.
• The significant scale test — the breach affects 500 or more individuals, regardless of the type of data involved.

Once you suspect a breach, the PDPA requires you to assess whether it is notifiable in a reasonable and expeditious manner. PDPC guidance expects that assessment to be completed generally within 30 calendar days of first becoming aware of a possible breach. Start containing the breach immediately; do not wait for the assessment to finish.

• Notify the PDPC no later than 3 calendar days after determining that the breach is notifiable, through the PDPC’s online data breach notification form. Be ready with how the breach happened, the number of individuals and types of data affected, what you have done to contain it, and your DPO’s contact details.
• Notify affected individuals where the breach is likely to cause them significant harm, at the same time as or after notifying the PDPC. Exceptions apply, for example where the data was protected by encryption before the breach. A breach that is notifiable only because of its scale (500 or more people) must be reported to the PDPC, but does not by itself require you to notify every individual.
• If a vendor holds the data for you — a payroll provider, IT contractor or cloud platform acting as your data intermediary — it must tell you immediately when it discovers a breach. It is then your job, not the vendor’s, to assess and notify. Make sure your vendor contracts say so.

Document your assessment, even when you conclude a breach is not notifiable. The PDPC may ask how you reached that view.

What this actually looks like for an SME

Most Singapore SMEs don't need an elaborate compliance programme — they need a handful of things done properly and kept up to date:

• A short, plain-language data protection policy, published on the website, that says what data you collect and why.
• A named DPO with contact details published, ideally registered through ACRA’s BizFile+.
• Consent language built into sign-up forms, job applications, and any marketing opt-ins — and a record of when consent was given.
• Basic access controls on customer and staff data (password-protected files, restricted shared drives, staff offboarding checklists).
• A simple, written breach response plan so that if something does go wrong, the 30-day assessment clock isn't the first time anyone has thought about the process.
• A retention schedule that says when old customer or applicant data gets deleted, rather than kept indefinitely "just in case."
• A check that you are not collecting NRIC numbers where you do not need them, on forms, visitor logs and sign-up pages.
• A DNC Registry check built into any SMS or call-based marketing.
• Data protection clauses in contracts with vendors that handle personal data for you, including a duty to report breaches to you immediately.

Penalties for non-compliance

Since 1 October 2022, the maximum financial penalty for breaching the data protection obligations is 10% of the organisation’s annual turnover in Singapore for organisations with Singapore turnover above S$10 million, and S$1 million for everyone else. For most SMEs, the S$1 million ceiling is the relevant one, and it is large enough to matter. The PDPC also publishes its enforcement decisions, so the reputational cost of a breach can outlast the fine. In practice, the PDPC takes into account whether an organisation had reasonable policies and acted quickly once a breach came to light, which is another reason to have the basics in place.

Frequently asked questions

Does the PDPA apply to small businesses in Singapore?

Yes. The Personal Data Protection Act applies to every organisation in Singapore’s private sector that collects, uses or discloses personal data, regardless of size. There is no exemption for small businesses, sole proprietorships or family-run firms.

Does every Singapore company need a Data Protection Officer?

Yes. Every organisation must designate at least one Data Protection Officer and make the DPO’s business contact information available to the public. For an SME this does not need to be a full-time role; an existing staff member can take it on. Registering the DPO through ACRA’s BizFile+ is voluntary but satisfies the requirement to publish the contact details.

Can my business collect NRIC numbers?

Generally not. Since 1 September 2019, PDPC guidelines restrict organisations from collecting, using or disclosing NRIC numbers unless it is required under the law or necessary to accurately establish or verify an individual’s identity to a high degree of fidelity. Use alternatives such as a mobile number, email address or membership number where you can.

When must a data breach be reported to the PDPC?

A breach must be reported if it is likely to cause significant harm to individuals or affects 500 or more individuals. PDPC guidance expects organisations to assess this generally within 30 calendar days of becoming aware of a possible breach, and to notify the PDPC no later than 3 calendar days after determining that the breach is notifiable. Affected individuals must also be notified where the breach is likely to cause them significant harm.

What are the penalties for PDPA non-compliance in Singapore?

Since 1 October 2022, the maximum financial penalty for breaching the data protection obligations is 10% of annual Singapore turnover for organisations with Singapore turnover above S$10 million, and S$1 million in other cases. Breaches of the Do Not Call provisions can also attract penalties of up to S$1 million for organisations.

The bottom line

The PDPA isn't a big-company problem, and for most SMEs it isn't an expensive one either — but it does need a named owner, a written policy, and a breach plan sitting in a drawer before you need it, not after. The highest-risk gap we see is not consent language on a website; it's not knowing who the DPO is, and not having a plan for the 30-day clock that starts the moment a breach is discovered.

If you're not sure whether your current data-handling practices would hold up, a short review is usually enough to find the gaps and close them. See our Advisory services to learn more about how we support SMEs on compliance matters like this. This article is general information and not legal advice.

Sources: PDPC, Data Protection Obligations; PDPC, Data Protection Officers; PDPC, Report Your Organisation’s Data Breach; PDPC, Guide to Handling Access Requests.