PDPA audit: where you stand and what to fix first
A PDPA audit, or gap assessment, checks how your organisation handles personal data against each obligation in the Personal Data Protection Act (PDPA). The audit suits any business, clinic or condominium that has never been checked. You get a written report: where you stand, what to fix first, and who does it.
Who asks for it, and what it shows them
The questions people ask you, and what this answers.
- Management“Where are we falling short today?”A structured check against PDPA duties (DPO, policies, staff communication, complaints) shows the gaps.Singapore Statutes Online (PDPA), read 12 Oct 2026
- Board and shareholders“What is our worst-case regulatory exposure?”The board sees the real picture: the median PDPC financial penalty is S$11,000, and every decision is published with the organisation’s name.PDPC enforcement decisions (firm Case Library), read 12 Oct 2026
- Regulators“Can you show you know what you hold and how you protect it?”Gap findings map to the s24 duty to make reasonable security arrangements.Singapore Statutes Online (PDPA), read 12 Oct 2026
- Insurers“Has a regulator ever looked at your data handling?”Insurer proposal forms ask about regulator investigations and complaints on personal data handling.MSIG Insurance (Singapore) Pte Ltd, read 12 Oct 2026
PDPC fined Air Sino-Euro Associates Travel S$47,000 and issued directions (8 Jan 2026) for not appointing a DPO, not implementing data protection policies and lacking reasonable security.
Personal Data Protection Commission (PDPC), read 12 Oct 2026What you get
- A check against each PDPA obligation, with the evidence noted
- A map of the personal data you hold and where it sits
- Your forms, notices and vendor contracts reviewed
- A written report ranking each gap by risk
- A fix plan with owners, dates and the evidence you need
- A written gap report, obligation by obligation
- A prioritised action plan with owners and dates
Our privacy consultants are Certified Information Privacy Managers (CIPM) and PDPC certified.
How it works
- You
Send us your forms, notices and system list, and book interviews with key staff.
- Us
We review the documents, interview your team and test each obligation against what we find.
- Result
You get the report and a fix plan you can run yourself or with us.
In our clients’ words
“PDPA Compliance was steady and reliable throughout. The work was structured, the support was responsive, and we always had the sense that the engagement was being handled smoothly.”
Latest on this topic
Common questions
What is a PDPA audit?
A structured check of how you collect, use, store, share and dispose of personal data, measured against the obligations the Personal Data Protection Commission (PDPC) enforces. The audit ends in a written list of gaps, ranked by risk, with the fix for each.
Is a PDPA audit the same as DPTM certification?
No. The audit is our review, for you. Data Protection Trustmark (DPTM) certification is an independent body’s audit that ends in a certificate. Many clients start with our audit, fix the gaps, then decide whether DPTM is worth it for them.
How long does a PDPA gap assessment take?
The time depends on how many sites, systems and forms hold personal data, and how quickly your team can meet us. We agree the dates in the proposal, before work starts. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
How much does a PDPA audit cost?
The cost follows the scope: staff and systems handling personal data, sites, and how much is already written down. You get a fixed-fee proposal after a short scoping call. Government grants may cover part of the cost. We check at your first call. Tell us your scope in 5 minutes and you get a fixed-fee proposal within 2 working days: Scope your project
Latest PDPC case on this topic · 2026-05-07 · Condominiums and managing agents · Directions only
Appointing a managing agent does not transfer the MCST's own accountability: it still needs its own DPO, policies and security arrangements covering data the agent processes.
Read the PDPC decision of 7 May 2026, on pdpc.gov.sg (opens in a new tab)Privacy work is led by a Certified Information Privacy Manager (CIPM), issued by the IAPP.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)