PDPA policy, notices and consent forms, written plainly
A privacy notice tells people why you collect their data; a PDPA policy tells your staff how to look after it. Every organisation under the Personal Data Protection Act (PDPA) needs both. We write yours to the minimum the law requires, because a published policy is a public promise. You get wording your staff can follow.
Who asks for it, and what it shows them
The questions people ask you, and what this answers.
- Customers“Why do you want my data and what will you do with it?”Notices tell customers the purposes. PDPC has acted where an organisation failed to notify people and get their consent.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Regulators“Do you check the Do Not Call register before marketing?”Marketing calls, texts and faxes to Singapore numbers are checked against the DNC Registry unless an exemption applies.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Regulators“Can people opt out of your marketing?”Messages carry an opt-out, and opt-outs are honoured within 21 days.Personal Data Protection Commission (PDPC), read 12 Oct 2026
- Employees“Which policy applies to my work?”Written policies exist and are communicated to staff (s12(a) and (c)).Singapore Statutes Online (PDPA), read 12 Oct 2026
PDPC fined Amicus Solutions S$48,000 and a financial consultant S$10,000 (Oct 2019) for disclosing individuals’ personal data for telemarketing without notifying them or getting consent.
Personal Data Protection Commission (PDPC), read 12 Oct 2026What you get
- A data protection policy and a public privacy notice
- Consent and purpose wording for your forms, apps and WhatsApp messages
- Closed-circuit television (CCTV) notices and a footage request procedure
- A Do Not Call (DNC) Registry check routine and a consent log
- National Registration Identity Card (NRIC) collection checked against PDPC guidelines
- Policies and notices, version-dated and published
- A consent log and Do Not Call check records for marketing
Missing policies were part of a S$20,000 penalty for a Singapore non-profit. PDPC, Aug 2024.
How it works
- You
Send us your current forms, notices, website and marketing messages.
- Us
We rewrite the data protection wording to what the law requires, nothing more.
- Result
You publish short, plain documents that match what your staff actually do.
In our clients’ words
“Within three months, we had the requested policy and other templates in place.”
Latest on this topic
Common questions
What should a PDPA privacy policy include?
Why you collect personal data, how you use and share it, how people can withdraw consent or ask for access and correction, and how to contact your data protection officer (DPO). Keep the policy to what you actually do.
Do I need to check the DNC Registry?
Yes, before you send marketing calls, texts or faxes to Singapore numbers, unless the person gave you clear and unambiguous consent. We set up the checks and a consent log so you can prove consent.
Can we collect NRIC numbers?
Only in limited cases. Personal Data Protection Commission (PDPC) guidelines limit collecting NRIC numbers and copies to cases the law requires or where identity must be verified to a high degree. We help you replace them on your forms.
Is a consent form template enough?
Rarely. A template does not know your purposes, systems or vendors. A form that promises more than you do creates obligations you then have to keep. We write wording that matches your practice.
Latest PDPC case on this topic · 2026-08-05 · Education and childcare · Voluntary undertaking
Honour opt-outs: once someone withdraws consent or is on the DNC register, stop messaging them, and put sender identification and contact details in every marketing message.
Read the PDPC decision of 5 August 2026, on pdpc.gov.sg (opens in a new tab)Privacy work is led by a Certified Information Privacy Manager (CIPM), issued by the IAPP.
Compliance is black and white. Your business isn’t.
Leave your details and an adviser replies within 2 office hours.
Download a one-page brief for your management or board (PDF, 68 KB)