PDPA Compliance Checklist for Apps and Websites in Singapore

Singapore’s Personal Data Protection Act 2012 (PDPA) governs how organizations collect, use and disclose personal data. If you are building an app, portal or website that serves people in Singapore, PDPA obligations should shape your design from the first sprint. This checklist translates the main obligations into practical product and engineering tasks.

This article is general guidance, not legal advice. Always check the latest guidance from the Personal Data Protection Commission (PDPC) and consult a qualified adviser for your situation.

1. Consent

• Collect personal data only with consent, unless an exception applies.
• Use clear, unticked opt-ins for optional uses such as marketing.
• Record when and how consent was given, and for what purpose.
• Make withdrawing consent easy, and act on it.

2. Purpose limitation and notification

• Tell users why you collect each type of data, in plain language, at or before the point of collection.
• Use data only for purposes a reasonable person would consider appropriate and that you have notified.
• Publish an accessible privacy policy and keep it up to date.

3. Access and correction

• Provide a way for individuals to request access to their personal data and how it has been used.
• Allow users to correct inaccurate data, ideally through self-service profile settings.

4. Accuracy

• Validate inputs and give users ways to keep their details current, especially where data drives decisions about them.

5. Protection

• Encrypt data in transit (TLS) and at rest.
• Apply role-based access control and least privilege for staff and systems.
• Use multi-factor authentication for administrative access.
• Log access to sensitive records and review logs.
• Test security regularly and patch dependencies.

6. Retention limitation

• Define retention periods per data type and delete or anonymize data when it is no longer needed for business or legal purposes.
• Automate deletion jobs and apply the same rules to backups and logs where practical.

7. Transfer limitation

• If personal data is transferred outside Singapore, for example to cloud servers in another region, ensure the recipient provides a comparable standard of protection, typically through contracts.
• Hosting in a Singapore cloud region can simplify this for many applications.

8. Accountability

• Appoint a Data Protection Officer and publish their business contact information.
• Document data flows, policies and staff training.
• Include data protection clauses in contracts with vendors and developers who process data for you.

9. Data breach notification

• Have an incident response plan that includes assessing whether a breach is notifiable.
• Under the PDPA, notifiable breaches (for example, those likely to cause significant harm, or affecting a large number of individuals) must be reported to the PDPC, generally within three calendar days of determining that they are notifiable, and affected individuals may also need to be informed.

10. Special care areas

• NRIC numbers: PDPC guidance restricts collecting, using and disclosing NRIC numbers unless required by law or necessary to verify identity to a high degree. Avoid using them as usernames or general identifiers.
• Marketing messages: check the Do Not Call provisions before sending marketing to Singapore phone numbers.
• Children’s data and health data deserve extra safeguards.

Building PDPA into your product

The cheapest time to address privacy is during design: consent screens, a data inventory, retention rules and access controls are much easier to build in than to retrofit. See our ClinicFlow concept project for an example of a Singapore app designed around these principles.

Frequently asked questions

Does the PDPA apply to foreign companies?

The PDPA can apply to organizations that collect, use or disclose personal data in Singapore, even if they are based overseas. Seek legal advice for your specific situation.

Do we need a Data Protection Officer?

Organizations covered by the PDPA are required to designate at least one individual responsible for compliance and make their business contact information available.

Can we host Singapore user data overseas?

Transfers are allowed if the data receives a comparable standard of protection, usually ensured through contracts. Many teams choose a Singapore cloud region for simplicity.