Privacy Policy (Singapore)

A Privacy Policy in Singapore documents the organisation's approach and the obligations placed on those it covers.

The PDPA establishes nine main obligations that a privacy policy must address: the Consent Obligation (Section 13 — obtaining consent for collection, use, and disclosure); the Purpose Limitation Obligation (Section 18 — collecting data only for purposes a reasonable person would consider appropriate); the Notification Obligation (Section 20 — notifying individuals of the purposes of collection); the Access and Correction Obligation (Sections 21-22 — allowing individuals to access and correct their data); the Accuracy Obligation (Section 23 — making reasonable efforts to keep data accurate); the Protection Obligation (Section 24 — protecting data with reasonable security arrangements); the Retention Limitation Obligation (Section 25 — ceasing to retain data when no longer needed); the Transfer Limitation Obligation (Section 26 — restricting transfers to overseas recipients); and the Data Breach Notification Obligation (Sections 26A-26E — notifying the PDPC and affected individuals of significant breaches).

The Personal Data Protection (Amendment) Act 2020 introduced significant enhancements effective 1 February 2021, including: mandatory data breach notification (Part VIA); an expanded basis for 'deemed consent' through notification (Section 15A) and contractual necessity (Section 15); new exceptions for legitimate interests (paragraph 1 of the Third Schedule, Part 3); enhanced financial penalties (up to 10% of annual turnover for organisations with revenue exceeding S$10 million); and criminal penalties for individuals who knowingly or recklessly misuse personal data (Section 48B).

The Do Not Call (DNC) Registry, established under the PDPA Part IX and administered by the PDPC, imposes additional obligations on organisations that send marketing messages to Singapore telephone numbers. Organisations must check the DNC Registry before sending marketing messages by voice call, text (SMS/MMS), or fax, and the privacy policy should address DNC compliance.

Sector-specific regulations supplement the PDPA for certain industries. The Banking Act (Cap. 19) and MAS Technology Risk Management Guidelines impose additional data protection requirements on financial institutions regulated by the Monetary Authority of Singapore (MAS). The Healthcare Services Act 2020 and the Ministry of Health's (MOH) guidelines impose specific requirements for healthcare data. The Cybersecurity Act 2018, administered by the Cyber Security Agency of Singapore (CSA), may require Critical Information Infrastructure (CII) owners to implement enhanced data protection measures.

The Spam Control Act 2007 (Cap. 311A) supplements the PDPA by regulating unsolicited commercial electronic messages sent in bulk, and organisations privacy policies should address compliance with both the PDPA and the Spam Control Act where applicable. The Electronic Transactions Act 2010 (Cap. 88) governs the validity of electronic records and signatures, relevant to online consent mechanisms used in privacy policies. The Trustees Act (Cap. 337) may apply where organisations hold personal data in a fiduciary capacity, such as trustee companies regulated by MAS.

A Privacy Policy is needed whenever an organisation in Singapore collects, uses, or discloses personal data of individuals and must comply with the PDPA 2012. The PDPA applies to all organisations in Singapore — defined broadly to include any individual, company, association, or body of persons operating in Singapore — with limited exceptions for public agencies and individuals acting in a personal or domestic capacity.

Businesses with websites or mobile applications that collect personal data from users — including names, email addresses, telephone numbers, payment information, IP addresses, and device identifiers — must publish a privacy policy accessible to users before or at the point of data collection. The PDPC expects all organisations with an online presence to maintain a clear and prominent privacy policy on their websites.

E-commerce businesses registered with ACRA and operating in Singapore must maintain privacy policies that address the collection of customer data during transactions, payment processing through payment service providers licensed by MAS under the Payment Services Act 2019, and the use of cookies and tracking technologies on their platforms. The Competition and Consumer Commission of Singapore (CCCS) also monitors unfair data practices under the Consumer Protection (Fair Trading) Act 2003 (CPFTA).

Organisations engaging in direct marketing — sending promotional messages by phone, SMS, email, or fax — must address DNC Registry compliance in their privacy policies. The PDPA Part IX requires organisations to check the DNC Registry (maintained by the PDPC) before sending marketing messages to Singapore telephone numbers, with financial penalties of up to S$1 million per breach.

Organisations transferring personal data outside Singapore — to overseas headquarters, cloud computing providers, data processors, or partner organisations — must address cross-border data transfer provisions (PDPA Section 26) in their privacy policies. The PDPC's Guide on Data Protection Clauses for Agreements Relating to the Processing of Personal Data provides model contractual clauses for cross-border transfers.

Organisations processing personal data of European Union residents must consider the interaction between the PDPA and the EU General Data Protection Regulation (GDPR), as the GDPR has extraterritorial reach. The PDPC and the European Commission have engaged in mutual recognition discussions, and organisations operating across both jurisdictions should maintain privacy policies that address both frameworks.

Startups, SMEs, and nonprofit organisations are not exempt from the PDPA. The PDPC's Data Protection Trustmark (DPTM) certification scheme provides SMEs with a framework for demonstrating PDPA compliance, and maintaining a clear privacy policy is a baseline requirement for DPTM certification.

A Privacy Policy compliant with the Personal Data Protection Act 2012 (PDPA) and the PDPC's published guidelines must include the following elements. The forms-legal.com Privacy Policy template for Singapore covers all mandatory and recommended provisions for PDPA compliance.

Organisation identification requires the organisation's full registered name, Unique Entity Number (UEN) as registered with ACRA, registered address, and website URL. The privacy policy should identify the organisation as the entity responsible for the personal data collected.

Types of personal data collected must list all categories of personal data the organisation collects, including: identification data (name, NRIC/FIN, date of birth); contact data (address, email, telephone); financial data (credit card numbers, bank account details); technical data (IP address, browser type, device identifiers, cookies); usage data (website browsing history, transaction history); and any special categories relevant to the organisation's business (health data, biometric data).

Purposes of collection, use, and disclosure must clearly state all purposes for which personal data is collected and used — responding to inquiries, processing transactions, providing services, marketing, analytics, compliance with legal obligations, and any other specific purposes. Each purpose must be one that a reasonable person would consider appropriate under Section 18 of the PDPA.

Consent framework must explain how the organisation obtains consent for data collection — whether express consent (affirmative opt-in), deemed consent (through notification under Section 15A or contractual necessity under Section 15), or reliance on exceptions under the First, Second, and Third Schedules (such as vital interests, publicly available data, or legitimate interests). The policy must explain how individuals can withdraw consent and the consequences of withdrawal.

Disclosure to third parties must identify the categories of third parties to whom personal data may be disclosed — service providers, payment processors, marketing partners, government agencies (IRAS, MOM, CPF Board), overseas affiliates, and professional advisers. For each category, the privacy policy should state the purpose of disclosure.

Cross-border data transfer provisions must address transfers of personal data outside Singapore under Section 26, identifying the countries or regions to which data may be transferred and the safeguards in place — contractual clauses, binding corporate rules, or the recipient country's comparable data protection standard.

Data retention policy must state the organisation's retention periods for different categories of personal data and the criteria used to determine retention periods. Section 25 of the PDPA requires organisations to cease retaining personal data when it is no longer necessary for any business or legal purpose.

Data protection measures must describe the security measures the organisation implements to protect personal data under the Protection Obligation (Section 24) — encryption, access controls, secure storage, regular security audits, and employee training. The PDPC's Guide on Data Protection Practices for ICT Systems provides technical guidance.

Data breach notification clause must inform individuals that, in the event of a notifiable data breach under PDPA Sections 26A-26E, the organisation will notify affected individuals and the PDPC within the prescribed timeframes.

Individual rights section must inform individuals of their rights under the PDPA: the right to access personal data (Section 21), the right to correct personal data (Section 22), the right to withdraw consent (Section 16), and the right to complain to the PDPC. The section should provide the Data Protection Officer's (DPO) contact details for exercising these rights.

Do Not Call Registry compliance section must address the organisation's obligations regarding the DNC Registry under PDPA Part IX, including the organisation's commitment to check the registry before sending marketing messages and the individual's right to register on the DNC Registry.