Your Jurisdiction at a Glance — Singapore
Personal Data Protection Act 2012 (PDPA), amended in 2020
Authority: Personal Data Protection Commission (PDPC)
- Appoint at least one Data Protection Officer and publish their business contact details
- Notify the PDPC within 3 calendar days after assessing that a breach is notifiable
- Do Not Call (DNC) Registry for marketing messages
- Stop using NRIC numbers for authentication by 31 December 2026
- Task 2 of this workshop: document Singapore in the data protection scope document, together with sector rules and other countries you operate in
- Workshop 2: governance, roles and the data protection officer
- Workshop 3: records of processing activities
- Workshop 8 and 9: risk assessment and security measures
- Workshop 10: vendors, processors and international transfers
- Workshop 11: data breaches and notification deadlines