Data protection essentials: the PDPA baseline for small teams
Data protection essentials is our starter package for small organisations: the baseline the Personal Data Protection Act (PDPA) expects, without a long project. The package is built on the Data Protection Essentials (DPE) framework published by the Infocomm Media Development Authority (IMDA). You get a named owner, short policies, basic security and a breach plan.
Who asks for it, and what it shows them
The questions people ask you, and what this answers.
- Management“We are small. What is the minimum we should do?”IMDA’s Data Protection Essentials gives SMEs a baseline standard of data protection and cybersecurity practices.Infocomm Media Development Authority (IMDA), read 12 Oct 2026
- Regulators“If we are breached, does doing the basics count?”IMDA says PDPC may consider an organisation’s implementation of the DPE framework favourably.Infocomm Media Development Authority (IMDA), read 12 Oct 2026
- Customers“Will my data be safe with a small business?”The DPE baseline exists to help SMEs safeguard their customers’ personal data.Infocomm Media Development Authority (IMDA), read 12 Oct 2026
- Employees“What do I actually need to do day to day?”A starter checklist covers appointing a DPO, a data protection policy, a breach response plan and a table-top test.Hosted by IMDA (document does not name its publisher), read 12 Oct 2026
PDPC fined Championtutor S$5,000 (Aug 2019) for having no data protection officer and no written PDPA policies and practices.
Personal Data Protection Commission (PDPC), read 12 Oct 2026What you get
- A data protection officer named, and the contact published
- Short policies and a privacy notice your staff can follow
- Basic security: passwords, updates, backups and device locks
- A one-page breach plan that says who calls whom
- A staff briefing, with the attendance record kept
- A baseline checklist, completed and dated
- The documents behind each item, in one folder
No DPO and no policies: a Singapore travel agency paid S$47,000. PDPC, Jan 2026.
How it works
- You
Tell us how your team collects, stores and shares customer data.
- Us
We set up the essentials with you in a short, fixed-scope project.
- Result
Your organisation has the PDPA basics in place, written down and working.
In our clients’ words
“PDPA Compliance was steady and reliable throughout. The work was structured, the support was responsive, and we always had the sense that the engagement was being handled smoothly.”
Latest on this topic
Common questions
What is the DPE framework?
A baseline of data protection and security practices for small and medium-sized businesses, published by IMDA. DPE is a framework, not a certificate. Our package puts that baseline in place for you.
Do we get a certificate?
No. Data protection essentials is a framework, not a certificate. If you want independent certification later, the Data Protection Trustmark (DPTM) is the certificate for data protection.
Is data protection essentials enough for the PDPA?
The package covers the baseline most small organisations need. Larger teams, sensitive data or many vendors usually need the full PDPA implementation. Either way, you meet the obligations the Personal Data Protection Commission (PDPC) enforces, step by step.
How much does it cost?
Data protection essentials is our smallest fixed-scope package. The fee depends on staff, sites and systems; you get a fixed-fee proposal after a short scoping call. Government grants may cover part of the cost. We check at your first call. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
Latest PDPC case on this topic · 2026-05-07 · Condominiums and managing agents · Directions only
Appointing a managing agent does not transfer the MCST's own accountability: it still needs its own DPO, policies and security arrangements covering data the agent processes.
Read the PDPC decision of 7 May 2026, on pdpc.gov.sg (opens in a new tab)Privacy work is led by a Certified Information Privacy Manager (CIPM), issued by the IAPP.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)