# Standards and Regulatory References — Singapore PDPA

## Primary Legislation

### Personal Data Protection Act 2012 (No. 26 of 2012)
- **Enacted**: 15 October 2012
- **Main provisions effective**: 2 July 2014
- **2020 Amendment Act**: Personal Data Protection (Amendment) Act 2020 (No. 40 of 2020), effective 1 February 2021
- **Key 2020 amendments**: Mandatory breach notification (Part VIA), deemed consent by notification (Section 15A), data portability (Part VIB), enhanced penalties (10% turnover cap)

### Spam Control Act 2007
- Governs unsolicited commercial electronic messages
- Complementary to PDPA DNC provisions for email marketing

## PDPC Advisory Guidelines

### Advisory Guidelines on Key Concepts
- **Consent**: Guidance on express, deemed, and deemed-by-notification consent
- **Purpose Limitation**: Reasonable person test; business improvement exception
- **Notification**: What constitutes adequate notification; timing requirements

### Advisory Guidelines on Selected Topics
- **Data Intermediaries**: Obligations and contractual requirements
- **Breach Notification**: Assessment framework; significant harm determination
- **Cross-Border Transfers**: Contractual safeguards; comparable protection standard
- **NRIC Numbers**: Restrictions on collection of National Registration Identity Card numbers (PDPC Advisory Guidelines on NRIC, 2018)

## Enforcement Precedents

### IHiS / SingHealth (2019)
- Fines: SGD 250,000 (IHiS) + SGD 750,000 (SingHealth) = SGD 1,000,000 total
- 1.5 million patient records accessed including Prime Minister
- Led to Healthcare Cybersecurity Strategy and enhanced PDPA enforcement

### Grab (2021) — SGD 10,000 for passenger data disclosure
### Razer (2022) — SGD 50,000 for server misconfiguration
### Integrated Health Information Systems (2023) — Multiple smaller actions for healthcare data breaches

## PDPA vs GDPR Key Differences

| Feature | Singapore PDPA | GDPR |
|---------|---------------|------|
| Consent model | Consent + deemed consent + exceptions | Six co-equal bases |
| DNC Registry | Yes (Part IX) | No equivalent (Member State e-Privacy rules) |
| Breach notification | 3 days after assessment (30-day assessment window) | 72 hours from awareness |
| Maximum fine | SGD 1M or 10% Singapore turnover | EUR 20M or 4% global turnover |
| Data intermediary | Protection/retention/transfer obligations only | Full processor obligations under Art. 28 |
| DPO requirement | Not mandatory (recommended) | Mandatory for certain organisations |
| Cross-border transfer | Comparable protection standard | Adequacy decisions / SCCs / BCRs |
| Data portability | Enacted but not yet effective | Effective since 2018 |