Singapore PDPA 2026: What Every SME Must Do to Stay Compliant
Under Singapore’s Personal Data Protection Act (PDPA), every organisation that collects, uses, or discloses personal data — regardless of size — must appoint a Data Protection Officer (DPO), implement data protection policies, and comply with 9 statutory obligations. There is no minimum threshold based on company size, revenue, or number of employees. A one-person startup with 50 customer email addresses has the same PDPA obligations as a multinational.
In 2026, enforcement has intensified. And there is a critical new requirement: from December 31, 2026, organisations must cease using NRIC numbers for authentication purposes. HeySara’s DPO Services help SMEs build compliant, practical data protection frameworks.
What Is the PDPA?
The Personal Data Protection Act 2012 (PDPA) is Singapore’s main legislation governing how private-sector organisations collect, use, disclose, and protect personal data. It is administered by the Personal Data Protection Commission (PDPC), which has the power to investigate complaints, issue directions, and impose financial penalties of up to S$1 million (or 10% of annual turnover, whichever is higher, for organisations with annual local turnover above S$10 million).
The PDPA was significantly strengthened by the Personal Data Protection (Amendment) Act 2020, which introduced: – Mandatory data breach notification — organisations must notify the PDPC and affected individuals when a breach is of a significant scale or likely to cause significant harm – Expanded deemed consent provisions – Increased financial penalties
In February 2026, the PDPC confirmed that the EU-Singapore Digital Trade Agreement (EUSDTA) entered into force on February 1, 2026. This introduces binding commitments relevant to cross-border data flows between Singapore and EU member states — important for Singapore companies dealing with EU customers or vendors.
The 9 PDPA Obligations Every Singapore Business Must Meet
1. Accountability Obligation Appoint at least one Data Protection Officer (DPO) and make their business contact details publicly available (e.g., on your website). Develop and implement a Data Protection Management Programme (DPMP).
2. Notification Obligation Inform individuals of the purpose for which you are collecting their personal data before or at the time of collection. Privacy notices and consent forms at sign-up are the standard mechanism.
3. Consent Obligation Obtain valid consent before collecting, using, or disclosing personal data. Consent must be freely given, informed, and specific. Individuals must be able to withdraw consent.
4. Purpose Limitation Obligation Use personal data only for the purposes it was collected for. You cannot repurpose or sell data without fresh consent.
5. Accuracy Obligation Make reasonable efforts to keep personal data accurate, complete, and up to date.
6. Protection Obligation Implement reasonable security arrangements to protect personal data from unauthorised access, use, disclosure, or modification. This is the most commonly enforced obligation by the PDPC.
7. Retention Limitation Obligation Do not keep personal data longer than it is needed for its original purpose. Implement a data retention schedule and deletion policy.
8. Transfer Limitation Obligation When transferring personal data to countries outside Singapore, ensure the recipient provides a comparable standard of data protection (typically through contractual safeguards).
9. Access and Correction Obligation Allow individuals to access their personal data held by your organisation and to request corrections within a reasonable timeframe.
The Mandatory DPO: What It Means for SMEs
Under Section 11(3) of the PDPA, every organisation subject to the PDPA must designate at least one individual as its DPO. There is no exemption based on size. Even dormant companies and holding companies with no employees must appoint a DPO if they hold personal data.
The DPO does not need to hold formal qualifications under the PDPA, but must have the knowledge and experience to: – Ensure the organisation complies with the PDPA – Handle data protection inquiries and complaints – Respond to the PDPC in the event of an investigation or breach
Many SMEs appoint an external DPO — a cost-effective approach that provides professional expertise without the overhead of a full-time hire. HeySara offers a DPO-as-a-Service solution tailored to Singapore SMEs.
Critical 2026 Update: NRIC Authentication Ban
In February 2026, the PDPC announced that all private organisations must cease using NRIC numbers for authentication purposes by December 31, 2026. This builds on the June 2025 advisory confirming that NRIC numbers — being widely shared identifiers — should not be used as passwords, verification codes, or authentication credentials.
Practices that must be phased out by end-2026: – Using NRIC numbers as default passwords or PINs – Combining NRIC with easily obtainable information (name, date of birth) as an authentication factor – Partial NRIC display as a security measure
Enforcement of this requirement is expected to intensify from January 1, 2027. SMEs using NRIC-based authentication in any customer-facing or employee-facing system should act now.
Mandatory Data Breach Notification
Under the PDPA, you must notify the PDPC within 3 calendar days (for breaches of a significant scale) and affected individuals within 3 business days if a data breach: – Affects 500 or more individuals, OR – Is likely to result in significant harm to affected individuals (e.g., financial loss, physical harm, reputational damage)
Most SMEs are not prepared for the speed of this requirement. HeySara’s DPO Services include breach response planning and notification support.
HeySara DPO Services
HeySara’s DPO-as-a-Service provides SMEs with: – A named, qualified DPO whose contact information can be published on your website and with the PDPC – A customised Data Protection Management Programme – Ongoing monitoring of PDPA compliance and regulatory updates – Data breach response planning and incident support – Staff training on data protection
The service is available as a standalone engagement or bundled with HeySara’s corporate secretarial and compliance packages.
