A PDPA website compliance checklist for Singapore businesses

PDPA website compliance comes down to a few habits: collect only the personal data you need, say why before you collect it, get consent where it's required, keep it secure, stop keeping it when you no longer need it, and publish a way to reach whoever looks after data protection. Most business websites collect personal data in more places than the owner realises: forms, booking widgets, newsletter sign-ups, and analytics and advertising tags. This checklist goes through each against guidance from the Personal Data Protection Commission (PDPC).

This is general information, not legal advice. For decisions about your own business, read the PDPC's guidance directly or speak to a lawyer.

What PDPA website compliance covers

The PDPC's Advisory Guidelines on Key Concepts in the PDPA (revised 29 April 2026) summarise ten main obligations. The Act applies to organisations of every size, including sole proprietors. On a typical website they show up like this:

Obligation	What it means on your website
consent	forms, sign-ups and tracking that collect personal data need consent, or a valid exception
purpose limitation and notification	say what you'll do with the data on or before collecting it, and use it only for reasonable purposes
access and correction	be able to find a person's data and give it to them or fix it on request
accuracy	take reasonable care that data you rely on is correct
protection	make reasonable security arrangements for forms, inboxes, admin logins and databases
retention limitation	stop keeping enquiries and records once there's no purpose or legal reason to keep them
transfer limitation	if a form tool, mailing platform or host stores data outside Singapore, meet the conditions for overseas transfers
data breach notification	assess suspected breaches quickly and notify when required
accountability	have policies and a complaints process, make information about them public, and appoint a data protection officer

For access requests, the guidelines say you must respond as soon as reasonably possible, and if you can't do so within 30 days, tell the person in writing within that time when you will.

Forms, bookings and mailing lists

Enquiry and booking forms

When someone fills in your enquiry form, they're voluntarily giving you their details. The PDPC treats that as deemed consent by conduct, limited to purposes that are "objectively obvious and reasonably appropriate" in the circumstances. Replying to their enquiry is obvious. Adding them to your promotions list is not.

What to check on each form:

• Ask only for what you need to respond. A name, one way to reply and a message are usually enough. Collecting more means more to justify, protect and eventually delete.
• State the purpose at the point of collection. A short line by the submit button, such as "We'll use these details to reply to your enquiry", with a link to your data protection policy. The guidelines say that if you notify people through a policy, they should have the chance to view it before you collect their data.
• Don't bundle marketing consent. Section 14(2) of the PDPA says you can't make consent to more than is reasonable a condition of providing your service. Use a separate, unticked checkbox for marketing.
• Be careful with NRIC numbers. The PDPC has separate advisory guidelines on NRIC and other national identification numbers; read them before asking for one on a form. And if your site lets people look up bookings or log in using an NRIC number, the PDPC has said private organisations must stop using NRIC numbers for authentication by 31 December 2026, with stepped-up enforcement from 1 January 2027.

If your customers include young people, as at a tuition centre, the PDPC's selected topics guidelines say a minor between 13 and 20 may give valid consent when the policies are readily understandable to them, and that an organisation may decide parental consent is more appropriate. For younger students, asking for a parent's details is the simpler route.

Newsletters and mailing lists

• Get clear consent for marketing, separately from the enquiry.
• Make withdrawing easy: an unsubscribe link in every email, and a named contact for requests. The PDPC's rule of thumb is that a withdrawal notice of at least ten business days is reasonable notice, and it's good practice to tell people if you need longer.
• Keep a record of when and how each person signed up.

Marketing by phone call, text message or fax

Sending marketing messages to Singapore phone numbers by voice call, text message or fax brings in the Do Not Call provisions. You must check the DNC Register first, unless the person has given clear and unambiguous consent in evidential form, and each message must identify you and how to contact you. A phone number collected by an enquiry form is not permission to send promotions to it.

Cookies, analytics and advertising tags

The PDPC addresses cookies in chapter 7 of its Advisory Guidelines on the PDPA for Selected Topics (revised 23 May 2024). Its main points for websites:

• The PDPA applies when cookies are used to collect, use or disclose personal data. Consent isn't needed for cookies that don't collect personal data.
• For activities the user has clearly asked for, and reasonable functions that can't work without cookies (the guidelines list authentication, security, user preferences, network management and streaming), consent may not need to be sought where the person knows the purpose and has provided their data voluntarily.
• Where advertising is targeted using cookies that collect personal data, consent is required. Browser settings can reflect consent, but failing to change them doesn't count. As good practice, the PDPC suggests letting people set their cookie preferences on the website.
• An IP address on its own may not be personal data, but the more data points you tie to it, the more likely it identifies someone.
• The consent obligation sits with the organisation collecting the data. If a tag feeds your own analytics or advertising account, assume that's you.

What to do on your site:

1. List every script on the site: analytics, advertising pixels, chat widgets, embedded maps and videos, booking and payment tools.
2. Note what each one collects and why. Remove anything nobody uses.
3. Give visitors a real choice before advertising and remarketing tags load.
4. Describe your cookies and tags in your data protection policy, in plain language.

Fewer third-party scripts also make the site faster, which our guide to WordPress, website builders and custom builds touches on.

Security, retention and the data protection officer

Protection

The Protection Obligation asks for "reasonable security arrangements". For a small business site, that usually means:

• HTTPS across the whole site
• software, themes and plugins kept up to date
• unique passwords and two-factor sign-in for the website admin, form tool, mailing platform and domain registrar
• only the people who need form submissions can see them
• backups that are themselves stored securely

The PDPC publishes its enforcement decisions, and reading a few protection cases is a quick way to see what "reasonable" means in practice. Ongoing website maintenance is where most of this lives after launch.

Retention

The PDPA doesn't set a fixed retention period. You should stop keeping personal data once it no longer serves the purpose it was collected for and isn't needed for legal or business reasons, while still meeting any industry-specific rules that apply to you. Pick a period for each kind of record (unsuccessful enquiries, past bookings, newsletter subscribers who never open anything) and apply it everywhere a copy lives: the form tool, your inbox, spreadsheets and your CRM.

Data protection officer

Section 11(3) of the PDPA requires you to designate at least one person responsible for compliance, usually called the data protection officer (DPO), and section 11(5) requires you to make the business contact information of at least one of them available. The guidelines say this can be on BizFile+ for ACRA-registered companies or in a readily accessible part of your website, reachable from Singapore during Singapore business hours. A data protection email address on your privacy page and in the footer does the job. The DPO needn't be an employee, but legal responsibility stays with your organisation. The PDPC runs an e-service to appoint or update your DPO.

Data breach notification

A website breach might be an exposed spreadsheet of form submissions, a compromised admin account or a mailing list sent to the wrong people. The guidelines set out what happens next:

1. Assess quickly. Once you have credible grounds to believe a breach has happened, take reasonable and expeditious steps to assess whether it's notifiable, generally within 30 calendar days, and document every step.
2. Decide if it's notifiable. A breach is notifiable if it is likely to result in significant harm to affected individuals (certain kinds of data are deemed to meet this test), or if it involves 500 or more individuals.
3. Notify the PDPC within three calendar days of deciding it's notifiable, counting from the day after. Decide on 1 January, and the deadline is 4 January. Use the PDPC's data breach reporting e-service.
4. Notify affected individuals where significant harm is likely, as soon as practicable, at the same time as or after notifying the PDPC.

A breach contained entirely within your organisation isn't notifiable. If your web developer, host or form provider processes data for you, they must tell you without undue delay when they find a breach, so make sure your contracts say who to contact. The PDPC's data breach management guide covers the process in more depth.

Summary checklist

• Forms ask only for what you need, state their purpose and link to your policy.
• Marketing consent is a separate, unticked option, recorded with a date.
• Nothing on the site uses NRIC numbers to authenticate people.
• Every script is listed and justified, and visitors can choose before advertising tags load.
• Your policy explains what you collect, why, who you share it with, and how to withdraw consent or request access.
• A DPO contact is published on the site.
• HTTPS, updates, two-factor sign-in and limited access are in place.
• Retention periods apply to every copy of the data, and overseas providers have been reviewed.
• A one-page breach plan names who assesses, who notifies and how.
• DNC checks happen before any call or text message marketing.

Much of this list is settled while a site is being built, in what the forms ask, where submissions go, which scripts load and who can sign in. We work through those decisions with you on any website development project. For where the privacy policy sits among your other pages, see what pages a small business website should have.