Data Protection Monitor
Global Privacy & Data Protection Intelligence

Singapore (SG) · Module Detail

Singapore: Regulator & Framework

← Full Singapore overview Build report with Singapore Request deeper dive

#

Mature, well-documented omnibus statute with a single clearly identified regulator and settled extraterritorial scope.

Primary frameworkPersonal Data Protection Act 2012 (No. 26 of 2012), as amended
Supervisory authorityPersonal Data Protection Commission (PDPC)
Traffic-light rationale — GreenMature, well-documented omnibus statute with a single clearly identified regulator and settled extraterritorial scope.

Sub-modules (5)

Regulator And AuthorityGreen

PDPC is the statutory enforcement authority, operating under IMDA since 2016.

Claims (2):

  • The Personal Data Protection Commission (PDPC) is empowered to investigate and enforce the PDPA provisions.
  • The PDPC was subsumed into the Info-communications Media Development Authority (IMDA) with effect from 1 October 2016.

Act And InstrumentsGreen

Core instrument is the PDPA 2012, last comprehensively amended in November 2020 with provisions phased in through 2021-2022, alongside the Spam Control Act for the Do Not Call regime.

Claims (1):

  • The Personal Data Protection Act 2012 (No. 26 of 2012) and the Spam Control Act 2007 were amended by Parliament in November 2020, with amendments including mandatory breach notification taking effect from 1 February 2021.

Material ScopeGreen

Material scope covers private-sector collection, use and disclosure of personal data; public agencies sit outside the PDPA under a separate governance statute.

Claims (1):

  • The PDPA applies only to private sector organisations; processing of personal data by public sector agencies is governed separately under the Public Sector (Governance) Act 2018.

Territorial ScopeGreen

Extraterritorial reach captures overseas organisations processing personal data in Singapore regardless of incorporation or residence.

Claims (1):

  • The PDPA has an extraterritorial scope and applies to overseas organisations that collect, use, or disclose personal data within Singapore, regardless of place of incorporation or residence.

Regulator Registration And FilingAmber

No general PDPC registration/filing regime exists; the principal filing-adjacent obligation is mandatory public DPO contact details.

Claims (1):

  • All organisations subject to the PDPA are required to appoint a Data Protection Officer (DPO) and make the DPO's business contact information publicly available.
Category narrative136 words

Singapore's omnibus regime is the Personal Data Protection Act 2012 (No. 26 of 2012, 'PDPA'), administered by the Personal Data Protection Commission (PDPC). <cite index="58-1">The PDPC is empowered to investigate and enforce the PDPA provisions.</cite> <cite index="51-18">With effect from 1 October 2016, the PDPC was subsumed into the IMDA, which is a statutory body under the Ministry of Communication and Information.</cite> <cite index="40-5">The PDPA applies only to private sector companies, as the processing of personal data by public sector bodies is governed by another law called the Public Sector Governance Act 2018.</cite> <cite index="40-3">PDPA has an extraterritorial scope similar to GDPR, and it applies to overseas organizations that collect, use, or disclose data within Singapore.</cite> <cite index="35-3">Under the PDPA, all organisations are required to appoint a DPO, whose business contact information must be made publicly available.</cite>

Periodic update · new data 2026-10-18

Regulator & Framework

The Personal Data Protection Act 2012 has been amended with effect 16 October 2026 by the Public Sector (Governance) (Amendment) Act 2026 (Act 2 of 2026), as recorded on Singapore Statutes Online's amendment history for the PDPA. The amendment is primarily a Public Sector (Governance) Act 2018 instrument, permitting directions on the sharing and use of government-held information with trusted external partners outside the public sector, but it reaches into the PDPA itself through a new section 48C(3), which extends PDPA-style misuse offences to individuals at those external partners. The precise text and full scope of section 48C(3) has not yet been retrieved, so it is not yet confirmed whether it alters any PDPA obligation beyond this offence extension.

This is a framework-level development rather than a change to the PDPA's core data-protection obligations: the consent, notification, and access/correction provisions that form the backbone of the Act are not reported as affected. What has changed is the perimeter of who can be criminally liable for misuse of government-held data once it passes to an external partner, and the fact that this liability can attach even to non-personal data, which sits outside the PDPA's own definitional scope. External partners remain separately and additionally bound by the PDPA for any personal data within the shared dataset that they process.

Outlook

Confirmation of the full text of section 48C(3) would clarify whether any broader PDPA obligation has shifted alongside the offence extension. Absent that confirmation, the framework-level reading is that PDPA enforcement exposure has been extended outward to a new category of actor without altering the underlying consent or processing rules that apply to organisations already within the Act's scope.

Sources and claims (6)
  1. ProbablePersonal Data Protection Commission — The Personal Data Protection Commission (PDPC) is empowered to investigate and enforce the PDPA provisions.observed
  2. ProbableOneTrust DataGuidance — The PDPC was subsumed into the Info-communications Media Development Authority (IMDA) with effect from 1 October 2016.observed
  3. ProbableOneTrust DataGuidance — The Personal Data Protection Act 2012 (No. 26 of 2012) and the Spam Control Act 2007 were amended by Parliament in November 2020, with amendments including mandatory breach notification taking effect from 1 February 2021.observed
  4. ProbablearXiv — The PDPA applies only to private sector organisations; processing of personal data by public sector agencies is governed separately under the Public Sector (Governance) Act 2018.observed
  5. ProbablearXiv — The PDPA has an extraterritorial scope and applies to overseas organisations that collect, use, or disclose personal data within Singapore, regardless of place of incorporation or residence.observed
  6. ProbableOneTrust DataGuidance — All organisations subject to the PDPA are required to appoint a Data Protection Officer (DPO) and make the DPO's business contact information publicly available.observed