PDPA and cyber security: common questions
Plain answers to the questions clients ask us most, grouped by what you need. Cannot find yours? Ask an adviser.
PDPA compliance
Does the PDPA apply to my organisation?
Almost certainly. The PDPA applies to any organisation that collects, uses or discloses personal data in Singapore, whatever its size or sector: a clinic, a condominium’s management corporation, a tuition centre, a salon or an online shop. Public agencies are the main exception.
Is a DPO mandatory in Singapore?
Yes. The PDPA requires every organisation to appoint at least one DPO and to make the DPO’s business contact available. Having no DPO was part of a S$47,000 Personal Data Protection Commission (PDPC) penalty on a travel agency, published in January 2026.
Can a DPO be a current member of staff?
Yes. Many organisations name a manager as DPO. The role needs time and know-how, so some appoint us instead, or ask us to support their own DPO. Either way, accountability stays with your organisation.
Can a vendor or managing agent be our DPO?
A vendor or managing agent can support the role, but your organisation stays accountable under the PDPA. Some organisations, such as condominium councils, appoint a DPO who is independent of the agent, so someone checks the agent’s practices on their behalf.
Can we collect NRIC numbers?
Only in limited cases. Personal Data Protection Commission (PDPC) guidelines limit collecting NRIC numbers and copies to cases the law requires or where identity must be verified to a high degree. We help you replace them on your forms.
Do I need to check the DNC Registry?
Yes, before you send marketing calls, texts or faxes to Singapore numbers, unless the person gave you clear and unambiguous consent. We set up the checks and a consent log so you can prove consent.
When is a data breach notifiable?
When the breach is likely to cause significant harm to the people affected, or affects 500 or more people. You must assess a suspected breach within 30 calendar days.
What happens if we breach the Personal Data Protection Act (PDPA)?
The PDPC can give directions, a warning or a financial penalty. Across 151 published decisions with a financial penalty, the median was S$11,000, and every decision is published with the organisation’s name. Many cases end with directions or a voluntary undertaking instead.
Are we responsible for data our vendors handle?
Yes. You stay responsible for personal data a vendor processes for you. Put data protection clauses in contracts, give vendors the access they need and no more, require two-factor login and remove access when the job ends.
Cyber security
Do small businesses need cyber security?
Yes. Most attacks are automated and look for any weak password or unpatched system, whatever the size of the business. The Personal Data Protection Act (PDPA) also requires reasonable security, and the Personal Data Protection Commission (PDPC) enforces that rule.
How do we prepare for ransomware?
Keep one backup offline or unchangeable and test restores, patch remote access, turn on two-factor login and rehearse your breach plan. Decide in advance who tells the Personal Data Protection Commission (PDPC) if personal data is hit.
How do we stop fake emails using our name?
Publish three email records for your domain: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC). Receiving servers can then reject emails that pretend to come from you. We set them up and check the reports.
Can staff use their own phones?
Yes. Device management can keep work apps and data in a separate, managed space on a personal phone, so you can remove company data without touching personal photos or messages.
Virtual CISO or full-time hire?
A full-time CISO suits large or regulated firms with constant security work. Many small and mid-sized firms need senior judgement a few days a month. A virtual CISO gives you that judgement, and you can scale the days up or down.
Certifications
What does DPTM certified mean?
DPTM certified means an independent assessment body has audited your organisation against the Data Protection Trustmark standard and found that your data protection practices meet it. You can then show the certification to customers and in tenders.
Cyber Essentials or Cyber Trust mark?
Cyber Essentials proves the basics. The Cyber Trust mark is risk-based, in five tiers, for organisations with more data or more complex systems. Choose by who is asking and what they need; we compare them side by side.
What is the difference between ISO 27001 and ISO 27701?
ISO/IEC 27001 protects all information. ISO/IEC 27701 focuses on personal data: privacy roles, purposes, consent, individuals’ rights and vendors. Many firms run both as one management system with one audit.
What if a client asks for proof of data protection?
Show a clear policy, a named data protection officer, trained staff and, if needed, a certificate such as the Data Protection Trustmark (DPTM) or ISO/IEC 27001. We help you prepare all four.
Is ISO 42001 mandatory?
No. ISO 42001 is voluntary. Certification gives clients and tender panels an independent answer to how you govern AI.
Training & Insurance
Is PDPA training mandatory?
The PDPA requires you to tell staff about your data protection policies and practices. Training is the practical way to meet that duty, and the attendance record is your evidence.
Which course should we start with?
Most organisations start with PDPA fundamentals for all staff and cyber hygiene for anyone using email. Managers add breach preparedness exercises; directors and councils take the board briefing.
What is a breach simulation exercise?
A discussion-based rehearsal. A facilitator presents an incident in stages, and each group talks through what it would do. Nothing is switched off; the aim is to test decisions, roles and the plan.
How we work
Fees, grants, timelines and independence.
Do you certify us?
No. We prepare you. An independent assessment body audits you and decides on certification, so the certificate means something.
Why don’t you publish prices?
Two organisations of the same size can need very different work. A fixed fee set after a short scoping call is fairer than a price list, and you see exactly what the fee covers.
Can a government grant pay for Personal Data Protection Act (PDPA) compliance?
Government grants may cover part of the cost. We check at your first call. Whether a project qualifies depends on the scheme’s rules and the agency’s decision, not on us.
Do you apply for the grant?
No. Your company applies. We prepare the proposal and supporting documents with you, and answer the agency’s questions about our scope.
How long does a PDPA implementation take?
The time depends on how much personal data you hold, how many systems and vendors touch it, and how fast your team can review drafts. We set the dates in the proposal after a short scoping call.
Do you work only with certain industries?
No. We work wherever personal data is handled. Our clients include a medical centre, condominiums, a construction firm, an accounting firm and a telecoms company, and the PDPA asks the same of all of them.
Already certified
Renewals, surveillance audits and keeping the certificate.
Our certificate is due for renewal. Can you help?
Yes. We check what has changed since your last audit, update the evidence pack and prepare you for the renewal assessment. The certification body still decides.
Can you prepare us for a surveillance audit?
Yes. We review the controls and records the auditor will sample, close any gaps and brief your team on what to expect on the day.
Our Data Protection Officer has left. What now?
Appoint a replacement and update the published business contact straight away; the PDPA requires a designated person. We can act as your named DPO while you decide.
Can we switch consultant after certification?
Yes. We start from your existing evidence pack, map it to what the next audit tests, and take over the monthly support without starting again.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)