Appointing a DPO isn't optional.

Yes. Every organisation in Singapore is required under the PDPA to designate at least one Data Protection Officer to oversee compliance, and to make that DPO's business contact information available to the public. Registering your DPO with PDPC satisfies this obligation.

In almost all cases, yes. The PDPA applies to any organisation — company, sole proprietorship, or unincorporated body — that collects, uses, or discloses personal data in Singapore, regardless of size. There's no small-business exemption from the requirement to appoint a DPO.

A DPO oversees your organisation's data protection responsibilities: making sure staff understand the PDPA, keeping an inventory of what personal data you hold and why, handling access and correction requests, responding to data breaches, and being the contact point for both PDPC and the public.

Yes. The DPO function doesn't need to be a dedicated in-house hire — it can be an outsourced service or an added responsibility within an existing role. This is exactly what our DPO-as-a-Service package covers.

PDPC's DPO Registry becomes publicly searchable. Anyone — customers, partners, auditors, regulators — will be able to look up whether your organisation has a registered DPO. Businesses without one, or with outdated registration details, become visibly exposed.

The PDPA sets out obligations covering the full data lifecycle: telling individuals why you're collecting their data, only using it for purposes they've consented to, keeping it accurate and secure, not holding onto it longer than needed, and being accountable for how it's managed — including appointing a DPO and making your policies available on request.

Any data — true or not — about an individual who can be identified from it, either on its own or combined with other information your organisation has or can reasonably access. Usually this takes at least two data points before someone becomes identifiable. Business contact information is generally excluded.

Yes — the Accountability Obligation requires organisations to have policies and practices in place to meet their PDPA duties, and to make information about those policies available to individuals who ask. This is typically documented in a Data Protection Management Programme (DPMP).

A DPMP is the overall framework — your organisation's data protection policies, processes, and governance structure. A DPIA is a specific risk assessment done for a particular system or process, and its findings feed into the DPMP. They're not two separate deliverables; a DPIA is a component of building or maintaining a DPMP.

A review is a few hours of work against an existing document — reading it, checking it against the PDPA's obligations, and telling you what's missing. Building a full DPMP or running a DPIA means mapping your actual data flows, drafting policy from scratch, and documenting governance — work that varies a lot by business size, so it's quoted once we know your scope rather than sold as a flat fee.

Notification is mandatory if the breach is likely to cause significant harm to affected individuals, or if it affects 500 or more individuals regardless of harm. Once you've assessed a breach as notifiable, PDPC must be told as soon as practicable — and no later than 3 calendar days after that assessment.

PDPC's response depends on the circumstances, but outcomes can range from a warning to a direction to a financial penalty. Appointing a DPO is the baseline PDPC expects of every organisation handling personal data.

Up to S$1 million per breach. For organisations with annual turnover in Singapore above S$10 million, the cap rises to 10% of that turnover if it's higher than $1 million. In practice, published PDPC decisions for SMEs are usually far below the statutory maximum.

PDPC can direct an organisation to stop the offending collection, use, or disclosure of data; to destroy data collected unlawfully; to comply with data access and correction requests; and to pay a financial penalty.