Singapore Personal Data Protection Act

Develop and implement written policies and practices covering every PDPA obligation, designate at least one Data Protection Officer and publish their business contact information, run a complaints-handling process, and make information about those policies available to individuals on request.

Applies when

Every organisation that collects, uses or discloses personal data in Singapore, regardless of size, including Singapore subsidiaries of Chinese groups.

Evidence to retain

• · Data protection policy and internal operating procedures
• · DPO appointment letter and screenshot of the published contact details
• · Log of data protection complaints and queries
• · Staff data protection training records

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Obtain valid consent before collecting, using or disclosing personal data (or confirm that deemed consent or a statutory exception applies), and notify the purposes at or before collection; notify any new purpose before that use. Do not make consent to processing beyond what is reasonable for the product a condition of supply, and confine purposes to those a reasonable person would consider appropriate.

Applies when

Organisations that supply products or services directly to individuals in Singapore, or that determine processing purposes on behalf of Singapore customers.

Evidence to retain

• · Privacy notice text with version history
• · Screenshots and event logs of the consent capture flow
• · Records of consent given and withdrawn
• · Purpose inventory and reasonableness assessment memo

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Deploy physical, technical, process and contractual controls proportionate to data sensitivity and processing scale, to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal. Data intermediaries are directly subject to this obligation.

Applies when

All organisations and data intermediaries, including Chinese vendors that merely run inference, host logs or label data for Singapore customers. Data intermediary status depends on a written contract (s.4(2)).

Evidence to retain

• · Inventory of security controls with a responsibility matrix
• · Access-review records
• · Penetration test or security assessment report
• · Encryption and key management policy

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

Stop retaining documents containing personal data, or remove the means by which the data can be associated with particular individuals, once the collection purpose is no longer served and retention is no longer necessary for legal or business purposes. In AI contexts this must expressly cover training sets, prompt and inference logs, vector stores and model checkpoints.

Applies when

Organisations and data intermediaries that retain training data, user prompts, inference outputs or human-annotation results.

Evidence to retain

• · Retention schedule covering training sets and logs
• · Deletion and de-identification execution records
• · Written justification for any extended retention
• · Minutes of periodic retention reviews

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Before transferring personal data outside Singapore, take appropriate steps to ascertain and ensure that the recipient is bound by legally enforceable obligations providing a standard of protection at least comparable to the PDPA. Legally enforceable obligations include law, contract, binding corporate rules or any other legally binding instrument; a recipient holding a recognised specified certification is treated as bound. Where consent is relied on instead, the individual must first receive a written reasonable summary of the protection available in that country, and consent must not be a condition of supply unless the transfer is reasonably necessary to provide the product or service.

Applies when

Chinese AI companies that route personal data collected in Singapore back to China for model training, human annotation, support or operations, and Chinese entities that must sign up as bound recipients.

Applies from: 2021-02-01

Evidence to retain

• · Data-flow map and transfer inventory
• · Data processing addendum containing legally enforceable obligations
• · Assessment record of the recipient’s standard of protection
• · If relying on consent: the written reasonable summary and consent records

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Conduct a reasonable and expeditious assessment on becoming aware of a possible breach; once assessed as a notifiable data breach, notify PDPC as soon as practicable and in any case no later than 3 calendar days after making that assessment, then notify affected individuals (required for the “significant harm” limb). The prescribed “significant scale” threshold is 500 or more affected individuals. Notification to individuals is excused where remedial action, or a technological measure already in place, makes significant harm unlikely.

Applies when

All organisations. A Chinese vendor acting as a data intermediary does not notify PDPC itself but must inform the principal organisation without delay, otherwise the 3-day clock cannot be met.

Deadline: Assessment to be reasonable and expeditious; notify PDPC within 3 calendar days of assessing the breach as notifiable

Applies from: 2021-02-01

Evidence to retain

• · Incident response plan with escalation path
• · Breach assessment record with timestamps and conclusion
• · Acknowledgement of the notification filed with PDPC
• · Notice text sent to affected individuals and proof of dispatch
• · Contractual notification-deadline clause with data intermediaries

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

On request, provide an individual with their personal data and information on how it has been used or disclosed in the past year, and correct errors or omissions within a reasonable time. Data held by a data intermediary but under the organisation’s control must be included. Refusals must fall within a statutory exception and be explained.

Applies when

Organisations. Data intermediaries have no standalone duty to respond but must assist the principal organisation in locating data.

Evidence to retain

• · Register of access and correction requests
• · Identity verification records
• · Response letters with any exception relied on
• · Records of retrieval instructions issued to data intermediaries

Estimated first-time effort: 3–8 person-days (estimate, not a commitment)