Who needs a data protection officer (DPO)
Every organisation designates at least one individual responsible for compliance (often called the DPO) and publishes a business contact for one of them.
As of 21 Oct 2026
When a breach must be reported
To the Personal Data Protection Commission (PDPC) no later than 3 calendar days after assessing a breach as notifiable; to affected individuals on or after that, where the breach is likely to cause them significant harm.
As of 21 Oct 2026
Penalties
Administrative fines up to 10% of annual Singapore turnover for organisations with turnover above S$10 million, otherwise up to S$1 million.
As of 21 Oct 2026
Sources
- PDPA 2012 s.11, s.26D, s.48JAs of 21 Oct 2026