Singapore PDPA
Personal Data Protection Act - consent, purpose limitation, notification, access/correction, accountability.
Personal Data Protection Act - consent, purpose limitation, notification, access/correction, accountability.
| Short name | SG PDPA |
| Region | Asia-Pacific |
| Country or scope | Singapore |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers SG PDPA
- Scan requirements: 6, all decided by a scan.
- Controls: the scan requirements below, plus 10 controls from Safeguard's control catalog for SG PDPA.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 23: 1 written for SG PDPA and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
SG-PDPA-24 Protection Obligation | Organisations must protect personal data in their possession or control by making reasonable security arrangements against unauthorised access, modification or disposal, including integrity assurance for processing software (PDPA 2012 s. 24) | Scan |
SG-PDPA-24-PATCH Reasonable ICT Security Upkeep | Reasonable security arrangements for electronic personal data include keeping software patched and updated, which requires the version of each deployed component to be recorded (PDPA 2012 s. 24; PDPC guidance on ICT security arrangements) | Scan |
SG-PDPA-11 Accountability and DPO Designation | Organisations are responsible for the personal data they handle and must designate at least one individual (the data protection officer) responsible for compliance, so documentation must record an accountable contact (PDPA 2012 s. 11) | Scan |
SG-PDPA-12 Documented Policies and Practices | Organisations must develop and implement policies and practices necessary to meet their PDPA obligations and make information about them available, so supporting technical records must be identifiable and timestamped (PDPA 2012 s. 12) | Scan |
SG-PDPA-26 Data Breach Assessment Readiness | Organisations must assess suspected data breaches and notify the PDPC of notifiable breaches, which requires quickly determining whether deployed components match a disclosed vulnerability (PDPA 2012 Part 6A, ss. 26A-26D, introduced by the 2020 amendment) | Scan |
SG-PDPA-4 Data Intermediary Accountability | An organisation engaging a data intermediary to process data on its behalf remains responsible as if it processed the data itself, which requires knowing the suppliers behind the processing software (PDPA 2012 s. 4(2)-(3)) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
PDPA-CONSENT | Consent Obligation |
PDPA-PURPOSE | Purpose Limitation Obligation |
PDPA-NOTIFICATION | Notification Obligation |
PDPA-ACCESS | Access & Correction Obligation |
PDPA-ACCURACY | Accuracy Obligation |
PDPA-PROTECTION | Protection Obligation |
PDPA-RETENTION | Retention Limitation Obligation |
PDPA-TRANSFER | Transfer Limitation Obligation |
PDPA-ACCOUNTABILITY | Accountability Obligation |
PDPA-DBN | Data Breach Notification Obligation |
Policy templates
Written for SG PDPA:
- Singapore PDPA Data Breach Notification Form & Procedure
And 22 from the standard set, adapted to SG PDPA.
Singapore Cybersecurity Act
CII cybersecurity requirements: software inventory, patch management, vulnerability reporting.
Solomon Islands National ICT / Privacy Framework
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.