Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Compliance With Singapore Privacy Obligations; Made Easier!

Compliance With Singapore Privacy Obligations; Made Easier!

Strict adherence with Singapore privacy obligations can be tricky especially with SMEs; here are few tips to make it easier
Strict adherence with Singapore privacy obligations can be tricky especially with SMEs; here are few tips to make it easier

The Personal Data Protection Act 2012 (PDPA) governs the collection, use, and disclosure of private personal data by organizations in Singapore. Through this legislation, companies are mandated to observe key obligations upon the general directive of the Personal Data Protection Commission (PDPC).

With the enactment of new regulations through its latest amendments, strict adherence with Singapore privacy obligations can be tricky especially with SMEs. Hence, we curated this article to give you tips in keeping up with your PDPA responsibilities and thus avoiding hefty penalties for noncompliance.

Also Read: A Review of PDPC Undertakings July 2021 Cases

1. Consent, Purpose Limitation and Notification Obligation

This obligation features a three-fold responsibility. Organizations are required by the PDPA to develop and implement policies and operation procedures that 1) notify their customers of the data collection, 2) notify them as to what extent the data is to be used, and 3) obtain their customer’s consent in providing such personal data.

To comply, your organization should:

  • Come up with a privacy policy that is available to public, such as those posted on company premises and/or website
  • Secure the customer’s consent through your terms and conditions
  • Always give your customers the option to withdraw their consent on the collection of personal data

2. Access and Correction Obligation

The PDPA requires that the collected information is open for scrutiny and correction. This means that upon request, companies must provide customers with their personal data which may also be changed upon the latter’s perusal.

To comply, your organization should:

  • Implement an SOP on catering customer’s request for updating, correcting, and deleting personal data
  • Ensure compliance with the 30-day Rule- PDPA gives an organization 30 days to act on a customer’s request for access. However, this can be extended by additional 30 days if the delay is justified. Nevertheless, it is best to act on a customer’s request post-haste.

3. Accuracy Obligation

Organizations are expected to verify the veracity of collected personal data, especially if such is to be used in making decisions that would affect the general customer experience.

To comply, your organization should:

  • Require your customers to attest the accuracy and completeness of provided personal data through verbal or written confirmation.
  • Contact third party provider to take extra steps in verifying the accuracy of the data collected.
Getting fully informed on your PDPA responsibilities is owning half the battle
Getting fully informed on your PDPA responsibilities is owning half the battle

4. Protection Obligation

As one of the highlights of Singapore’s privacy obligations, organizations are expected to prevent any unauthorized access, collection, use, disclosure or disposal of stored customer data.

To comply, your organization should:

  • Adapt a robust cybersecurity protocol by ensuring that your computer networks are 100% secured and your employees well-trained in handling threats.
  • Exercise precautionary measures by marking confidential documents clearly and prominently; storing such in secured cabinet systems; and restricting employee access only to those who are qualified to handle such sensitive information.

5. Retention Limitation Obligation

The PDPA requires companies to dispose stored personal data once they have served their purpose.

To comply, your organization should:

  • Implement an appropriate personal data protection policy which clearly outlines periodic review of stored private data.
  • Practice proper cybersecurity hygiene by disposing personal data as soon as it is no longer useful. Some ways on how to go about this is by; 1) returning the documents to the customer, 2) destroying the documents, 3) “anonymising” the personal data

6. Transfer Limitation Obligation

This obligation is fairly straightforward as companies are not allowed to transfer data to any country outside of Singapore.

7. Openness Obligation

This obligation is different than the second obligation insofar as this mandates companies to develop and implement policies for complying with Singapore privacy obligations under the PDPA.

8. Do-Not-Call-Provisions

As one of the pillars of the PDPA, companies are required to check the DNC registry within 30 days of sending marketing material to a customer through a registered Singapore phone number.

The exemption to this rule is when the customer have already expressed their unambiguous consent to receive marketing messages through their Singapore phone number.

As we have always expressed in our PDPA-compliance articles, getting fully informed on your responsibilities is owning half the battle. When you know your Singapore privacy obligations inside and out, adherence to the rules becomes way easier. Verily, your chance of incurring a violation lessens and your customer’s private personal data are afforded with far greater security.

Hiring a DPO can help.

Aside from the fact that it is mandatory under the PDPA, an outsourced Data Protection Officer (DPO) oversees data protection responsibilities and ensures that organizations comply with the all the obligations under the Personal Data Protection Act (PDPA). Furthermore, every Organization’s DPO should be able to curb any instances of PDPA noncompliance as it is the officer responsible for maintaining the positive posture of an organization’s cybersecurity.

Also Read: Got A Notice of Data Breach? Don’t Panic!



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us