Rights
PDPA with mandatory breach notification
The Personal Data Protection Act governs private-sector data use and is enforced by the PDPC. Amendments in 2020 introduced mandatory breach notification and a higher financial cap.
Key rules
- Notifiable breaches must be reported to the PDPC within three calendar days of assessment.
- The Do Not Call registry restricts marketing to Singapore telephone numbers.
- Consent may be deemed or exempted for legitimate interests in defined situations.
Governing law
- Personal Data Protection Act 2012
Penalties and consequences
- Up to 10% of annual Singapore turnover or S$1 million, whichever is higher
In practice
The PDPC publishes detailed decisions, so its expectations on access controls and vendor management are unusually easy to research.