Who Must Comply — And There Are No Exceptions
The first question most SME owners ask is: "Does the PDPA apply to a company my size?" The answer is unambiguous. The Personal Data Protection Act (PDPA) applies to every organisation that collects, uses or discloses personal data in Singapore — regardless of headcount, revenue, incorporation type, or industry sector.
There is no "small business exemption." A five-person logistics firm that keeps a customer contacts spreadsheet is subject to the same legal framework as a multinational bank. The obligations are the same; what differs is the proportionality of the controls you implement. A large financial institution and a 10-person accounting firm both need to comply — but the controls for the accounting firm do not need to be as elaborate.
The PDPA was enacted in 2012 and significantly strengthened by the PDPA Amendment Act in 2020. The 2020 amendments introduced mandatory data breach notification, enhanced financial penalties tied to annual turnover, and new obligations around accountability and data portability. From 30 September 2024, a further requirement took effect that many SMEs have still not addressed: the mandatory appointment of a Data Protection Officer.
Financial Penalties Under PDPA
Financial penalties can be up to 10% of annual turnover in Singapore, or S$1 million — whichever is higher. For Do-Not-Call (DNC) Registry violations, fines reach up to S$10,000 per contravening message. The PDPC has been increasingly active in enforcement since the 2020 amendments, and enforcement decisions are published publicly — meaning reputational damage compounds the financial penalty.
The Mandatory DPO Requirement — Are You Compliant?
Since 30 September 2024, every organisation in Singapore must formally appoint a Data Protection Officer (DPO). This is not optional, and it does not depend on your company size. It is a legal requirement under the accountability obligation of the PDPA.
Two things are required — not one. You must appoint a DPO, and you must make the DPO's business contact information publicly accessible. This typically means publishing the DPO's name (or a role title like "Data Protection Officer") and a business email address or contact number on your company website, in your email footer, or in your physical premises. Making this information available only upon request is not sufficient.
The DPO does not need to be a dedicated full-time employee. Many SMEs use one of three approaches:
Internal appointment
An existing employee — often the HR manager, compliance officer, or operations lead — takes on DPO responsibilities as part of their role. This works if the person is given proper training and sufficient time to fulfil the duties.
Outsourced DPO (DPOaaS)
A qualified external consultant or firm is appointed as the DPO. This is common among SMEs that need a credentialled, experienced DPO without the cost of a full-time hire. The external DPO's business contact details are published on the company's website. SG Venture Consulting's DPO as a Service works this way.
Business owner as DPO
In very small businesses, the owner-founder may serve as DPO — this is permitted. However, the owner must understand their obligations and actively fulfil the DPO role. Simply nominating yourself without acting on the responsibilities is not compliance.
Check Your Website Now
If your company website does not currently show a DPO name and contact information — either on a dedicated Privacy Notice page or in your footer — you are technically in breach of the accountability obligation. This is one of the easiest compliance gaps to fix today at zero cost.
The 11 Obligations: What They Actually Mean for Your Business
The PDPA is structured around 11 core data protection obligations. For most SME owners, the challenge is not understanding what they are — it is understanding what they require your business to actually do differently. Here is a practical read of each:
Accountability
Appoint a DPO, develop data protection policies, and make DPO contact details public. This is where most SMEs fail first.
Collection Limitation
Only collect data you actually need. Collecting customer IC numbers "just in case" when a mobile number suffices is a common violation.
Purpose Limitation
Only use data for the purpose it was collected for. You cannot use a customer's email from a past transaction to market unrelated services without separate consent.
Notification
Tell people why you are collecting their data before or at the point of collection. A privacy notice on your contact form is the practical implementation.
Consent
Get genuine, informed consent. Pre-ticked boxes and bundled consents ("by using this service you agree to receive marketing") are not valid under PDPA.
Accuracy
Keep personal data accurate — especially when you will use it to make a decision about someone, or share it with another party.
Protection
Put reasonable security measures in place. For SMEs, this means password-protecting files containing personal data, restricting access, and not sharing customer lists via unsecured channels.
Retention Limitation
Delete personal data when you no longer need it. Many SMEs retain old HR records and customer databases indefinitely — this is a common, easy-to-overlook breach.
Access & Correction
Individuals can request to see what data you hold on them, and to correct errors. You must have a process to handle these requests within a reasonable timeframe.
Data Portability
Upon request, transmit an individual's data to another organisation in a machine-readable format, where technically feasible. Relevant when customers switch service providers.
Transfer Limitation
When sending personal data outside Singapore — including to cloud services, overseas suppliers, or foreign offices — ensure the recipient provides comparable PDPA-level protection.
In addition to these 11 obligations, the Do-Not-Call (DNC) Registry provisions prohibit organisations from sending marketing messages — voice calls, SMS, or fax — to Singapore telephone numbers registered on the DNC Registry, unless the individual has given clear prior consent. Always check the DNC Registry before any marketing campaign. Violations carry fines of up to S$10,000 per contravening message.
"The 11 obligations are not 11 separate projects. They are a coherent system. When you genuinely understand why each one exists — to protect individuals from harm and preserve trust — the compliance steps follow naturally."
— Patrick Oh, speaking at SNEF, 26 June 2026Data Breach Notification: A Mandatory 3-Day Clock
One of the most significant changes introduced by the 2020 amendments is the mandatory data breach notification obligation. This is no longer discretionary — it is a legal requirement with a tight timeline that many SMEs are not prepared for.
If a data breach occurs and it is — or is likely to be — of significant harm to the affected individuals, your organisation must:
Assess the breach
Determine whether the breach is notifiable under PDPA — i.e., whether it is likely to cause significant harm (financial loss, physical harm, reputational damage, identity fraud) to the affected individuals.
Notify the PDPC
Report to the Personal Data Protection Commission (PDPC) within 3 calendar days of determining that the breach is notifiable. Note: this is 3 calendar days from determination, not from discovery.
Notify affected individuals
Notify the individuals whose data was breached — in most cases, also within 3 days. The notification must be clear, direct, and tell individuals what happened, what data was affected, and what they should do to protect themselves.
Here is the critical point that catches most organisations off-guard: the 3-day clock starts when you have determined the breach is notifiable — not when the investigation is complete. You cannot take weeks to investigate before deciding whether to notify. You need to move fast, and you need a response plan ready before any breach occurs.
Breaches of lower severity — those not likely to cause significant harm — do not need to be reported to the PDPC or individuals, but they must still be assessed and documented internally. Your DPO must maintain a breach register.
Every Organisation Needs a Breach Response Plan
A breach response plan is not just for large corporations. It is a simple, documented procedure that tells your team: who to call, what to assess, how to decide if a breach is notifiable, and how to communicate. Without it, 3 calendar days is not enough time to improvise. SGVC includes a Data Breach Response Plan in our PDPA documentation package — see our PDPA services.
The 5 Places SMEs Most Commonly Fail PDPA Audits
Based on SG Venture Consulting's gap assessment work with Singapore SMEs across multiple sectors, these are the five compliance gaps we encounter most consistently:
1. No formal DPO appointment documentation
Many organisations have someone informally "handling privacy" but have never issued a formal appointment letter or published the DPO's contact details. Without documentation, the appointment is not legally effective.
2. Consent obtained through bundled or pre-ticked checkboxes
Contact forms, booking forms, and membership applications frequently bundle marketing consent with service consent. The PDPC has been clear: consent for marketing must be separate, unchecked by default, and genuinely voluntary.
3. No data retention and disposal schedule
Most SMEs have no documented answer to the question: "How long do we keep customer data, and what happens to it after that?" The retention limitation obligation requires a deliberate, documented answer — and a practice that follows it.
4. Forwarding personal data to third parties without processor agreements
Sending customer data to your payroll vendor, your IT support company, your CRM software, or your overseas distributor is a data transfer. The PDPA requires that you ensure third parties who process data on your behalf provide comparable protection — typically through a data processing agreement (DPA). Most SMEs have never executed one.
5. Staff with no PDPA training
Data breaches are most commonly caused by human error — staff sending files to the wrong email, sharing passwords, or disposing of documents without shredding. Compliance is only as strong as the least-trained person in your organisation. A one-hour annual briefing for all staff is a proportionate, effective control.
How to Get Started Without Being Overwhelmed
PDPA compliance does not need to be tackled all at once. A practical sequence for a Singapore SME starting from scratch looks like this:
Appoint your DPO and publish their contact details
This is the most urgent gap for most SMEs since the September 2024 deadline. Name a DPO — internal or outsourced — and add their contact details to your website Privacy Notice or footer today.
Conduct a data inventory
Map what personal data you collect, why you collect it, where it is stored, who has access to it, and whether it is shared with third parties. This does not need to be complex — a spreadsheet will do for most SMEs.
Fix your consent mechanisms and privacy notice
Review every point where you collect data (website forms, paper forms, customer registrations) and ensure the purpose is stated and consent is properly obtained. Draft or update your Privacy Notice.
Implement basic security controls
Ensure personal data is password-protected, access is limited to those who need it, and documents are disposed of securely. Review your email practices — are customer lists sent unencrypted?
Draft a breach response plan
Before a breach happens, document your response procedure. Name the person responsible for breach assessment, the PDPC's notification portal, and the steps for notifying affected individuals.
Train your staff
Hold a basic PDPA awareness session for all staff. Cover: what personal data is, what your policies are, and what to do if there is a breach or a data subject request.
Can You Fund PDPA Compliance With Government Grants?
For Singapore SMEs, the answer is often yes. The Enterprise Development Grant (EDG), administered by Enterprise Singapore, can fund up to 50% of qualifying PDPA compliance and data governance consulting fees. For companies in selected industries, the subsidy may be as high as 70%.
SG Venture Consulting is an Enterprise Singapore Approved management consulting firm, which means our PDPA consulting fees may qualify for EDG funding. The grant covers the consulting engagement — gap assessment, policy development, DPO advisory, DPTM readiness — but not the S$2,400 EDG application and project closing administration fee, which is charged separately.
For training specifically, the SkillsFuture Enterprise Credit (SFEC) provides eligible employers S$10,000 in credits that can be applied to PDPA staff training programmes.
Going Further: The Data Protection Trustmark (DPTM)
For SMEs that want to signal data protection maturity to enterprise customers, government procurement, or international partners, the SS714:2025 Data Protection Trustmark (DPTM) is Singapore's voluntary national certification standard. Jointly developed by PDPC and IMDA, and accredited by the Singapore Accreditation Council (SAC) from July 2025, DPTM goes beyond baseline PDPA compliance to an independently audited standard of accountable data protection. SGVC provides full DPTM readiness preparation. Learn more about DPTM →
The Bottom Line
PDPA compliance is not a bureaucratic burden — it is the minimum standard of care that individuals in Singapore reasonably expect when they share their personal data with your business. Getting it right protects your customers, protects your business from financial and reputational risk, and increasingly, it determines whether enterprise clients and government agencies will engage with you at all.
The good news for Singapore SMEs: the compliance baseline is achievable. You do not need to transform your organisation overnight. Start with the DPO appointment. Build from there. With the right guidance, most SMEs can reach a solid baseline compliance posture within 3–4 months — and potentially fund a significant portion of it through EnterpriseSG grants.
If you are not sure where your organisation stands, a PDPA gap assessment is the right starting point. It gives you a clear picture of what you have, what you are missing, and the order in which to address the gaps.
Not Sure Where Your Organisation Stands?
Book a complimentary PDPA readiness call with Patrick Oh. We will give you an honest assessment of your current posture, identify the most urgent gaps, and advise on whether EDG funding applies to your situation.
✦ Book a Free PDPA Consultation