PDPA FAQs

Under the scope of the PDPA, there is no classification on “sensitive data” unlike the General Data Protection Regulations (GDPR), the data protection jurisdictions that covers countries of the European Union.

Before an organisation uses any personal data, it is essential to ensure that there is already permission to use the data. Moreover, if the organisation is going to use local phone numbers for telemarketing or advertisement, then it is essential

There are several benefits to complying to PDPA. There are two key benefits that stand out. One of the benefits of compliance is that it helps to build trust among stakeholders that include customers, staff and even shareholders. Customers including

There is no business that operate in Singapore that can be exempted from the PDPA. In fact, under the scope of the PDPA, all organisations in Singapore have to comply with the PDPA. This includes all organisations operating in Singapore

‘Publicly available’ in relation to personal data about an individual, means personal data that is generally available to the public. This includes personal data which can be observed by reasonably expected means at a location or an event – (a)

The Spam Control Act (SCA) sets out a framework to manage unsolicited commercial electronic messages sent in bulk through electronic mail, text and multimedia messaging, otherwise known as “spam”. The SCA requires organisations to, among others, provide an unsubscribe facility

The provisions of the PDPA were formulated keeping in mind the need to keep compliance costs manageable for businesses. A transition period was provided to allow organisations sufficient time to phase in the necessary measures to comply with the data

The PDPA will strengthen Singapore’s overall economic competitiveness and enhance Singapore’s status as a trusted hub and choice location for global data management and processing services. The law will provide greater clarity on the rules and liabilities for businesses hosting

The PDPA aims to safeguard individuals’ personal data against misuse by regulating the proper management of personal data. Generally, individuals have the right to be informed of the purposes for which organisations are collecting, using or disclosing their personal data,

The PDPA was implemented in phases to allow time for organisations to adjust to the new law. The Do Not Call (DNC) Registry provisions came into force on 2 January 2014 and the personal data protection provisions came into force