Singapore PDPA
Personal Data Protection Act 2012 (Singapore) — PDPC (Personal Data Protection Commission)
Also known as: PDPA, Singapore PDPA, PDPC, Personal Data Protection Act 2012
Official site Official change log Subscribe to Singapore PDPA (RSS)
At a glance
- Current version
- Personal Data Protection Act 2012 (version of 16 October 2026)
- Published 16 October 2026. source
- Status
- In force
- Next deadline
- None announced
- How it is assessed
- Organisations designate someone responsible for compliance, publish contact details and notify notifiable data breaches within three calendar days. source
- Authority
- An Act of the Singapore Parliament administered and enforced by the Personal Data Protection Commission (PDPC). source
- Enforced by
- The PDPC issues directions and financial penalties of up to 10% of Singapore turnover or S$1 million; a recent decision fined Marina Bay Sands S$315,000. source
- Last change
Singapore's data protection regime, under which organisations must notify the Commission and affected individuals of notifiable data breaches. The Act sets the duties; the Commission's advisory guidelines show how it applies them.
Recent changes
-
Info
PDPC accepts voluntary undertaking from X Star Financial Services Pte Ltd
The Personal Data Protection Commission (PDPC) in Singapore has accepted a voluntary undertaking from X Star Financial Services Pte Ltd as part of an enforcement decision. …
-
Info
PDPC issues voluntary undertaking with DCS Card Centre Pte Ltd
The Personal Data Protection Commission (PDPC) of Singapore has accepted a voluntary undertaking from DCS Card Centre Pte Ltd following an investigation into data protection compliance. …
-
Info
PDPC issues enforcement decision against KLP LLP for breach of protection and accountability obligations
The Personal Data Protection Commission (PDPC) of Singapore issued an enforcement decision against KLP LLP for breaching protection and accountability obligations. This decision establishes precedent for …
-
Info
PDPC issues enforcement decision on data protection breach by Courts Singapore Pte Ltd
The PDPC has issued an enforcement decision finding that Courts Singapore Pte Ltd breached the protection obligation under the Personal Data Protection Act. This decision sets …
-
Info
PDPC publishes voluntary undertaking by Grace Orchard School
The PDPC has published a voluntary undertaking from Grace Orchard School following an enforcement investigation. This undertaking sets out commitments to address any identified breaches of …
-
Info
PDPC accepts voluntary undertaking from Bee Cheng Hiang Marketing Pte Ltd
The Personal Data Protection Commission (PDPC) of Singapore has accepted a voluntary undertaking from Bee Cheng Hiang Marketing Pte Ltd following a data protection investigation. This …
-
Info
PDPC accepts voluntary undertaking from Delugs Pte Ltd
The Personal Data Protection Commission (PDPC) of Singapore has accepted a voluntary undertaking from Delugs Pte Ltd in connection with a data protection matter. This undertaking …
-
Info
PDPC accepts voluntary undertaking from Prosegur Singapore regarding data protection compliance
The Personal Data Protection Commission (PDPC) of Singapore has accepted a voluntary undertaking from Prosegur Singapore Pte Ltd following a data protection investigation. The undertaking commits …
That is the last 90 days. Sign in to read further back.
Key dates
No upcoming dates- Amendments by the Public Sector (Governance) (Amendment) Act 2026 take effect
- PDPC imposes a S$315,000 financial penalty on Marina Bay Sands
- Maximum financial penalty rises to 10% of annual turnover in Singapore for larger organisations
- Amendments by the Personal Data Protection (Amendment) Act 2020 take effect
Amendments
-
Personal Data Protection Act 2012 (version of 16 October 2026) AmendmentCurrent text
Related amendments to section 48C by the Public Sector (Governance) (Amendment) Act 2026 (Act 2 of 2026), on data sharing and use directions between public agencies. source
-
Amended 5 December 2025 Amendment
The Statutes (Miscellaneous Amendments) Act 2025 (Act 19 of 2025) deleted one sub-paragraph in the Second Schedule. source
-
Amended 1 October 2022 (higher financial penalties) Amendment
The higher maximum financial penalty of the Personal Data Protection (Amendment) Act 2020 took effect: up to 10% of annual turnover in Singapore for organisations with turnover above S$10 million. source
-
Amended 1 April 2022 Amendment
The Courts (Civil and Criminal Justice) Reform Act 2021 (Act 25 of 2021) replaced the word "plaintiff" with "claimant". source
-
2020 Revised Edition Revision
The Act was republished in the 2020 Revised Edition of Singapore statutes. source
Show 3 older amendments
-
Amended 1 February 2021 (2020 amendments) Amendment
Amendments by the Personal Data Protection (Amendment) Act 2020 (Act 40 of 2020) took effect; the Act also inserted Part 6A on notification of data breaches. source
-
Amended 2 January 2021 Amendment
Amended by the Supreme Court of Judicature (Amendment) Act 2019 (Act 40 of 2019). source
-
Personal Data Protection Act 2012 (Act 26 of 2012) Major version
The Act's first provisions took effect on 2 January 2013; others followed in 2013 and 2014. source
Who it applies to
The PDPA covers organisations of any form, whether or not based in Singapore, with exclusions for individuals in a personal capacity, employees and public agencies.
- Organisations
- Any individual, company, association or body of persons, corporate or unincorporated, whether or not formed or recognised under Singapore law or resident or with an office in Singapore (section 2(1)). source
- Excluded
- Parts 3 to 6B impose no obligation on individuals acting in a personal or domestic capacity, employees acting in the course of employment, or public agencies (section 4(1)). source
- Data intermediaries
- An intermediary processing for another organisation under a written contract is subject only to some obligations, including protection and retention (section 4(2)). source
How compliance is assessed
Organisations designate someone responsible for compliance, publish contact details and notify notifiable data breaches within three calendar days.
- Responsible person
- Designate one or more individuals to be responsible for ensuring compliance, and make their business contact information available to the public (section 11). source
- Breach notification
- Notify the Commission as soon as practicable and no later than 3 calendar days after assessing a breach as notifiable, then notify affected individuals (section 26D). source
Enforcement and penalties
The PDPC issues directions and financial penalties of up to 10% of Singapore turnover or S$1 million; a recent decision fined Marina Bay Sands S$315,000.
Up to 10% of annual turnover in Singapore
Section 48J(3)(a), for contraventions on or after 1 October 2022 by an organisation whose annual turnover in Singapore exceeds S$10 million. source
Up to S$1 million
Section 48J(3)(b), in any other case. source
- Commission powers
- The Commission can give directions for non-compliance and impose financial penalties (sections 48I and 48J), or accept voluntary undertakings (section 48L). source
Recent fines
-
S$315,000
Marina Bay Sands Pte. Ltd., for a breach in which the customer records of about 665,495 loyalty programme members were accessed and exfiltrated ([2025] SGPDPC 6). source
Documents
Frequently asked questions
What is the maximum PDPA fine in Singapore?
For contraventions from 1 October 2022, up to 10% of annual turnover in Singapore for organisations with turnover above S$10 million, otherwise up to S$1 million (section 48J). source
How fast must a data breach be reported under the PDPA?
To the Commission as soon as practicable and within 3 calendar days after the organisation assesses the breach as notifiable (section 26D). source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to Singapore PDPA (RSS)