Singapore
PDPA basics for a small website
What Singapore's data protection law asks of an ordinary website: consent, notice, a DPO, and what to do about a breach.
- Tell visitors what personal data you collect and why, using a privacy notice on your site.
- Collect only the data you need, keep it secure with HTTPS and updates, and delete it when it is no longer needed.
- Appoint a Data Protection Officer (yourself if you are a sole proprietor) and publish a contact method on your site.
- Notify the Personal Data Protection Commission if a breach causes significant harm to affected individuals.
If your website has a contact form, you collect personal data. That is enough to bring you under Singapore’s Personal Data Protection Act (PDPA). This page explains what that means for a small site like yours.
This is a plain-language summary. It is not legal advice. For your exact situation, talk to a lawyer.
What counts as personal data
Any information that can identify an individual. A name, an email address, a phone number, an IP address. If your contact form asks for a name and an email, you are collecting personal data. If your server logs IP addresses, you are collecting personal data.
The PDPA applies to any organisation that collects, uses or discloses personal data in Singapore. That includes a free shared hosting account running a small business site.
The four things you must do
The PDPA is built around a few straightforward obligations.
Tell people what you collect and why. Before or at the time you collect data, you must inform the person. A privacy notice on your site does this. It should say what data you collect, why you collect it, and who to contact with questions. Our privacy notice is a worked example you can look at.
Collect only what you need. If you only need an email address to reply to an enquiry, do not also ask for a phone number and home address. This is the “purpose limitation” principle.
Keep it safe. You must make reasonable security arrangements to protect the personal data you hold. On shared hosting, that means using HTTPS (free automatic SSL is included), keeping your CMS and plugins updated, and not storing sensitive data in plain text files.
Delete it when you are done. Once you no longer need the personal data for the purpose you collected it, you must dispose of it. If a customer enquiry is resolved, delete the email or archive it in a way that removes personal identifiers.
You need a Data Protection Officer
Every organisation in Singapore must appoint at least one Data Protection Officer (DPO) and make their contact information publicly available. For a one-person business, that person is you. Put an email address or a contact form on your site. Our help page shows one way to do this.
Data breach notification
If a data breach occurs and it is likely to result in significant harm to the affected individuals, you must notify the Personal Data Protection Commission (PDPC) and the affected individuals. You must notify the PDPC no later than 3 calendar days after you assess the breach is notifiable, and the affected individuals as soon as practicable. Check the PDPC’s current guidance for the exact deadlines and thresholds, because these can change.
A “breach” includes unauthorised access, collection, use, disclosure, copying, modification or loss of personal data. If someone guesses your FTP password and downloads your contact form submissions, that is a breach.
Practical steps for your site
Your contact form. When someone fills in a contact form, their data goes to your email or a database. You need to tell them what happens to it. A short sentence under the submit button is enough: “We will use this information to reply to your enquiry and delete it afterwards.” If you use a contact form that sends email, note that outbound SMTP is blocked on free hosting. You will need a third-party form service or an API.
Your privacy page. Write a privacy notice and link to it in your site footer. Keep it simple. Say what you collect, why, how long you keep it, and how to contact your DPO. Use our privacy notice as a reference.
Your page furniture. The meta tag generator can help you add a description and author tags to your pages. This is not a PDPA requirement, but it helps visitors understand who runs the site.
What the PDPA does not require
It does not require you to register with the PDPC. It does not require you to have a formal privacy policy written by a lawyer, though that is a good idea. It does not require you to encrypt data at rest on your server, though you should if you store anything sensitive.
Where the obligations end
If you stop collecting personal data and delete everything you already have, most of the PDPA obligations no longer apply to you. But if you keep a mailing list, a customer database, or even a spreadsheet of enquiries, the obligations remain.
PDPA for a small website
The PDPA is not complicated for a small site. Tell people what you collect and why. Collect only what you need. Keep it safe. Delete it when done. Appoint a DPO and publish a contact. Notify the PDPC if there is a serious breach. That is the practical core of it.
If you have questions about your specific setup, get in touch through our help page.