Is your business PDPA compliant?
A quick checklist of the 16 things every Singapore SME should have in place. Tick off what you already do and see where the gaps are.
16 things every SME should have in place.
Tick what you already do. Your answers stay on this device; nothing is sent to us.
General guidance only, not legal advice. For the full obligations, see pdpc.gov.sg.
Questions about PDPA compliance.
Appointing a DPO, telling people why you collect their data and getting consent where needed, only using data for those purposes, keeping it accurate and secure, deleting it when no longer needed, handling access and correction requests, and responding properly to data breaches.
Yes. The PDPA applies to any organisation that collects, uses or discloses personal data in Singapore, regardless of size. There is no small-business exemption.
Generally not. Organisations should only collect NRIC numbers where the law requires it, or where it's necessary to verify someone's identity to a high degree of accuracy.
Yes, before sending marketing calls, SMS or messages to Singapore numbers, unless the person has given clear and unambiguous consent to receive them.
Start with appointing and registering your DPO, since the DPO Registry is now public. Then get a policy review to see which other gaps matter most for your business.
General guidance only, not a substitute for legal advice. Full detail at pdpc.gov.sg.
More from Core Vault.
Found some gaps?
A $500 PDPA Policy Review tells you exactly what to fix first, obligation by obligation.