Singapore PDPA

Singapore's Personal Data Protection Act.

Also known as: Singapore PDPA, PDPA Singapore, Personal Data Protection Act

Singapore’s PDPA (Personal Data Protection Act) governs collection, use, disclosure and care of personal data: consent (deemed in more situations than founders expect), purpose limitation, protection obligations, access/correction rights, and mandatory breach notification past thresholds. Enforcement is active and fines are real — this is complied-with law, not decorative text.

duties:  consent (or valid exception) + purpose limits + protection + access/correction
         + breach notification + DPO appointment + cross-border care

For startups the sharp edges are breach notification (assess fast, notify when thresholds trigger — rehearse the playbook, don’t discover it mid-incident), marketing consent (telemarketing and bulk messages need clear consent trails), and employee data (often forgotten until a dispute).

The classic mistakes:

Assuming EU/GDPR compliance transfers. Overlapping principles, different specifics — deemed consent, DNC registry rules and local enforcement practice need Singapore-specific review.
No data protection officer. Appointing a DPO (even a part-time or outsourced one) is required and checked; “the CTO handles privacy” without designation fails the letter and the spirit.
Breach discovered without a plan. No playbook means improvising notification decisions under the clock. Write down who decides, who notifies and with what templates before the incident.
Vendor data sprawling uncontracted. Analytics, support and cloud tools processing user data need DPAs and transfer assessments — the startup’s responsibility, not the vendor’s.
Employee and applicant data ignored. Resumes, monitoring tools, references — personal data with the same duties. Cover the whole lifecycle, not just customers.

Pair with: a real privacy policy, consent flows that match the law (not dark patterns), and counsel review before regional expansion multiplies the regimes. Compare Malaysia’s PDPA and Indonesia’s UU PDP where you operate across borders.