PDPA and cyber security for beauty, wellness and fitness businesses
We work across sectors. Here is what matters most in yours.
The 3 most recent PDPC decisions in your sector
2021-06-10 · Voluntary undertaking
A dismissed employee still had access to the customer database and the social media account.
Lesson: Remove access and change passwords on a leaver’s last day.
Read the PDPC decision of 10 June 2021, on pdpc.gov.sg (opens in a new tab)2020-08-03 · Warning
Employees’ personal data could be reached over the internet.
Lesson: Protect staff records as carefully as customer data.
Read the PDPC decision of 3 August 2020, on pdpc.gov.sg (opens in a new tab)2018-01-23 · Directions
Four hair salons had no data protection policies.
Lesson: Every organisation needs written policies, however small.
Read the PDPC decision of 23 January 2018, on pdpc.gov.sg (opens in a new tab)
Source: PDPC Case Library, read 12 October 2026.What PDPC decisions show
Where organisations like yours are most often exposed
The gap areas our free check asks about most for your sector.
- CCTV notices and footage requests not handled to PDPACCTV footage is personal data. Missing notices and loose access are common findings.How we help: Policies, notices and consent
- Paper records and disposal not controlledPaper records and old devices are easy to overlook and easy to lose.How we help: PDPA implementation, turnkey
- NRIC numbers or copies collected without needCollecting NRIC numbers without need adds risk you do not have to carry.How we help: Policies, notices and consent
- No written data protection policiesWithout written data protection policies, a single complaint can turn into a PDPC finding.How we help: PDPA implementation, turnkey
Certificates that most often fit your sector
From every answer path of our “Which certification fits?” questions for your sector. Side by side, as choices.
Common questions
Do we need consent for before-and-after photos?
Yes, if the client can be identified. Tell clients why you take photos and where the photos may appear, record their consent, and ask separately before marketing use. Clients can withdraw consent later.
Can we send promotions on WhatsApp?
Yes, if the client agreed to receive promotions. Unless that consent is clear and unambiguous, check the number against the Do Not Call Registry first. We set up the consent log and checks.
Can we ask for NRIC numbers at sign-up?
Usually not. Personal Data Protection Commission (PDPC) guidelines limit collecting NRIC numbers to cases the law requires or where identity must be verified to a high degree. A phone number or email usually does the job.
Do salons need a data protection officer?
Yes. Every organisation must appoint one. Publish how to contact that person. A staff member can take the role, or we can act as your named data protection officer (DPO).
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)