Is Your Website PDPA-Compliant? A Checklist for Singapore Businesses

Singapore's Personal Data Protection Act (PDPA) applies to almost every business that collects personal data — and your website is usually where most of that collection happens. Contact forms, newsletter sign-ups, bookings, live chat and checkouts all count.

The PDPC can impose significant financial penalties for breaches, and a data leak can damage customer trust far more than any fine. The good news: most website-level requirements are straightforward to get right.

This article is general guidance, not legal advice. Consult a qualified professional for your specific situation.

Your website PDPA checklist

• **Collect only what you need.** If you don't need a customer's NRIC, date of birth or home address, don't ask for it. NRIC numbers in particular should only be collected when required by law or truly necessary to verify identity.
• **Explain why you're collecting data.** Add short, clear purpose statements next to forms — for example, "We'll use your email to reply to your enquiry."
• **Get clear consent for marketing.** Use an unticked checkbox for newsletters and promotions. Remember the Do Not Call (DNC) rules if you plan to send marketing messages by phone or SMS.
• **Publish a privacy policy.** Explain what you collect, why, who you share it with, how long you keep it and how people can contact you.
• **Name a Data Protection Officer.** Every organisation must appoint one and make their business contact information available.
• **Secure the data.** HTTPS everywhere, strong admin passwords, two-factor authentication, regular updates and encrypted backups.
• **Limit who can access it.** Staff and vendors should only see the data they need for their role.
• **Delete what you no longer need.** Set retention periods for enquiries, orders and CVs.
• **Plan for breaches.** Know how you'll assess a data breach and, if it's notifiable, inform the PDPC within three calendar days of your assessment.

Watch your third-party tools

Analytics, chat widgets, CRMs, payment providers and email platforms all handle your customers' data. Choose reputable providers, understand where data is stored, and review their terms.

Build it in, don't bolt it on

Privacy is far easier to design into a website than to retrofit. At VRN Digital, every website and app we build for Singapore businesses includes secure forms, consent-ready layouts, HTTPS and hardened hosting as standard. Ask us for a website privacy and security review.