CevroSingapore: Singapore PDPA and what it requires
Personal Data Protection Act 2012 (PDPA): an established law with an active enforcement record. Overseen by Personal Data Protection Commission (PDPC).
Key requirements at a glance
| Registration with the regulator | Not required |
|---|---|
| Data protection officer | Required |
| Breach notification | Within 72 hours |
| Cross-border transfer restrictions | Required |
| Data localization | Not required |
Penalties and enforcement
Financial penalties of up to 10% of annual turnover in Singapore for larger organisations (lower fixed caps otherwise).
What to know in practice
Breach clock: notify the PDPC within 3 calendar days of assessing a breach as notifiable (significant harm, or 500 or more individuals), counted from the assessment, not from the breach itself. Applies to foreign organisations that collect, use or disclose personal data in Singapore. Overseas transfers need comparable protection.
The security duty
Under s.24: Protection obligation: reasonable security arrangements to prevent unauthorised access, collection, use, disclosure and similar risks. Source: published text, checked 2026-10.
How Cevro helps
- Maps Singapore PDPA to the rest of your compliance program, so evidence collected for SOC 2 or ISO 27001 also counts here where it overlaps.
- Counts your automated technical checks as evidence toward the security duty in s.24.
- Gives every failing control a specific fix and a way to re-check it.
Frequently asked questions
Who regulates data protection in Singapore?
Personal Data Protection Commission (PDPC) oversees Personal Data Protection Act 2012 (PDPA).
Is breach notification mandatory under Singapore PDPA?
The law sets a 72-hour window for notifying the regulator of a personal data breach, so you need detection and an incident process that can meet it.
Does Singapore restrict cross-border data transfers?
Yes. Moving personal data out of Singapore is restricted, so confirm a lawful transfer basis before data leaves the jurisdiction.
Do you need a data protection officer under Singapore PDPA?
Yes. Appointing a data protection officer is required.
What are the penalties for non-compliance in Singapore?
Financial penalties of up to 10% of annual turnover in Singapore for larger organisations (lower fixed caps otherwise).