Navigating Data Protection with Clarity

The PDPA applies to all private sector organisations that collect, use, or disclose personal data of individuals in the course of their activities. This includes companies, sole proprietors, associations, and NGOs — regardless of size. Certain categories of data and some public agencies operate under separate frameworks, but most private organisations operating in Singapore are within scope.

The assessment covers a review of how your organisation collects, uses, stores, and discloses personal data, an evaluation of consent practices, a review of existing data protection policies, and identification of gaps relative to current PDPA requirements. The process typically requires an initial information-gathering session followed by document review. The detailed report with prioritised recommendations is generally delivered within two to three weeks, depending on the complexity of your operations.

Under Singapore's mandatory data breach notification framework, organisations are required to notify the PDPC within three calendar days of assessing that a notifiable breach has occurred, and to notify affected individuals if the breach is likely to result in significant harm. Determining whether a breach meets the notification threshold requires careful assessment of the nature of data involved and the likely consequences. Our Breach Response Advisory service covers this assessment and notification preparation process.

Yes. The PDPA does not contain an exemption based on organisation size. Any private sector organisation that handles personal data of individuals in Singapore is subject to its obligations. That said, the practical scope of compliance activities — and the documentation required — can be proportionate to the scale and nature of your data processing activities. A compliance assessment can help identify what is genuinely necessary for an organisation of your size and sector.

The PDPC recommends that organisations review and update their data protection policies and practices regularly, and particularly when there are changes to business operations, the introduction of new data processing activities, or amendments to the PDPA or relevant advisory guidelines. Many organisations find that an annual review, combined with ad hoc updates for material operational changes, provides a reasonable baseline. Our services support both initial implementation and periodic reassessment.

The walkthrough session, included with our Data Protection Policy Drafting service, is designed to help relevant staff understand the purpose and application of the documents we have drafted. It covers the key obligations each policy addresses, how to use the procedures in practice, and how to handle common scenarios such as data access requests or suspected incidents. The session format can be adapted to your team's size and the documents produced.