PDPA compliance in Singapore

An act to govern and administer personal data collection, usage and disclosure by organisations is known as PDPA in Singapore. It functions as a baseline standard for personal data protection and supports sector-specific regulatory frameworks including Banking and Insurance Acts.

Singapore PDPA compliance needs organisations to comply with specific requirements for collection, use, disclosure and care of personal data in Singapore.

In today’s world, huge amounts of personal data are collected, used and even transferred to third-party organisations daily for a variety of reasons and are growing exponentially as the processing and analysis of large amounts of personal data becomes possible with sophisticated technology and computing power.

However, the usage of large personal data poses concerns to individuals and authorities about their data usage and disclosure. The concerns about personal data are driving data protection regimes for framing appropriate policies for the governance of personal data.

The PDPA also focuses on promoting Singapore’s competitiveness as a trusted business hub to foreign investors, authorities and consumers by enacting mandatory PDPA compliance in Singapore.

The PDPA recognises both the need to protect individuals’ data and the need of organisations to collect, use or disclose personal data for legitimate and reasonable purposes.

Singapore PDPA compliance is also necessary to safeguard sensitive personal data from any misuse and fraudulent act.

Personal data stored both in electronic and non-electronic formats comes under the purview of PDPA with the following exemptions applied.

• Individuals acting on a personal or domestic capacity
• Individuals acting as employees with an organisation
• Public agencies about the collection, use or disclosure of personal data
• Business contact information including individual’s name, position, title, business telephone number, business address, business email, business fax number and any similar information

Different types of data protection obligations apply to business organisations specifying regulatory requirements for PDPA compliance in Singapore when they perform activities relating to the collection, use or disclosure of personal data.