PDPA Checklist for a Business Website in Singapore
Short answer: a business website in Singapore that collects names, phone numbers or emails must say why it collects them, get consent for that purpose, name a contact for data protection questions, protect the data and delete it when no longer needed. Marketing messages to Singapore numbers need a Do Not Call check. A notifiable data breach must be reported to the PDPC no later than 3 calendar days after you assess it as notifiable.
This page summarises official PDPC publications, checked October 2026. It is not legal advice. Confirm your position with a lawyer or the PDPC guidelines.
The one-page checklist
| Item | What to put on the website | PDPA basis |
|---|---|---|
| Purpose statement | One line beside every form saying what the data is used for | Notification Obligation |
| Consent | The visitor submits the form after reading the purpose line | Consent Obligation |
| Marketing opt-in | A separate, unticked box for newsletters or promotions | Consent and Purpose Limitation |
| Privacy page | Purposes, who receives the data, retention, how to withdraw consent | Accountability Obligation |
| DPO contact | Business email or WhatsApp of the data protection officer | Accountability Obligation |
| Collect only what you need | Name and one contact channel for an enquiry, not NRIC or date of birth | Purpose Limitation Obligation |
| Security | HTTPS, form data stored in an access-controlled system, not a shared inbox | Protection Obligation |
| Retention | A written period after which enquiries are deleted | Retention Limitation Obligation |
| Cookies and analytics | Consent before advertising cookies that collect personal data | PDPC Selected Topics guidelines |
| Do Not Call | Registry check within 21 days before sending marketing to Singapore numbers | DNC provisions |
| Breach plan | Named owner, 30-day assessment, 3-day notification | Data Breach Notification Obligation |
Consent wording on forms
The PDPC list of obligations says organisations must notify individuals of the purposes for collection, and only collect, use or disclose personal data for purposes the individual has consented to.
On a form this means one plain line above the submit button. For example: "We use your name and number to reply to this enquiry. See our privacy policy." Link the privacy page.
Keep marketing separate. The same PDPC page states that an organisation may not require consent beyond what is reasonable as a condition of providing a product or service. A required box that bundles "reply to my enquiry" with "send me promotions" fails that test in spirit. Use a second, unticked box for marketing.
Individuals may withdraw consent. The privacy page should say how, and the business must then stop using the data for that purpose.
Purpose and notification
State each purpose in words a customer understands:
- Reply to your enquiry.
- Prepare a quotation.
- Send the newsletter you subscribed to.
- Improve the website using anonymised visit data.
A purpose not stated at collection needs fresh consent before you use the data for it.
Data protection officer contact
The PDPC lists, under the Accountability Obligation, designating a data protection officer and making the DPO's business contact information available to the public. It also expects data protection policies, practices and a complaints process to be available on request.
For a small business the DPO can be the owner or an office manager. Put a business contact channel on the privacy page. Do not publish a personal mobile number if a business channel exists.
Retention
The Retention Limitation Obligation requires an organisation to stop retaining personal data, or dispose of it properly, when it is no longer needed for any business or legal purpose.
Set a period and write it down. A common pattern is to keep unconverted enquiries for a fixed number of months and delete them after. Customer records follow your accounting and contract periods. Apply the period to every copy: the form tool, the inbox, spreadsheets and the CRM.
Cookies and analytics
PDPC's Advisory Guidelines on the PDPA for Selected Topics.pdf) set out three points:
- Consent is not needed for cookies that do not collect personal data.
- Consent may not be needed for activities the user clearly requested, such as storing what they type into a form or security and authentication cookies.
- Where advertisement targeting collects and uses personal data through cookies, consent is required. As good practice, PDPC suggests letting visitors set cookie preferences on the website.
The guidelines also state that failing to manage browser settings does not imply consent. If the site runs advertising pixels or remarketing tags, add a cookie preference control. If it runs only first-party, anonymised analytics, the case for a banner is weaker. Check what each script on the site collects before deciding.
Do Not Call for marketing messages
The Advisory Guidelines on the Do Not Call Provisions apply to voice calls, SMS and data applications such as WhatsApp, iMessage or Viber that use a Singapore telephone number.
Before sending a marketing message to a Singapore number:
- Check the number against the DNC Registry within 21 days before sending, or hold clear and unambiguous consent evidenced in written or other accessible form.
- Include who sent the message and how to contact the sender. That information must be likely to stay valid for at least 30 days after sending.
- Honour withdrawals. The guidelines set 21 days for a withdrawal of consent to take effect.
Replying to a person who asked about your product is different. The same guidelines state that a message sent for the sole purpose of responding to a request for information about a good or service would generally not be a specified message. See WhatsApp vs contact form for how this affects enquiry buttons.
Data breach notification: 30 days and 3 days
PDPC's Guide on Managing and Notifying Data Breaches sets the timeline:
| Step | Deadline |
|---|---|
| Assess whether the breach is notifiable | Within 30 calendar days of credible grounds to believe a breach occurred |
| Notify the PDPC | As soon as practicable, no later than 3 calendar days after assessing it as notifiable |
| Notify affected individuals | As soon as practicable, at the same time as or after notifying the PDPC |
A breach is notifiable if it results in, or is likely to result in, significant harm to an affected individual, or if it affects 500 or more individuals. Name one person who owns this process. For a website, the usual breach points are a hacked plugin, an exposed form inbox and a shared admin password.
Website build checks
- Every form has a purpose line and a privacy link.
- Marketing consent is a separate, unticked box.
- The privacy page names the DPO business contact.
- Form submissions go to an access-controlled store, with consent recorded beside each one.
- No unused fields: remove NRIC, date of birth and address unless the service needs them.
- Advertising cookies wait for consent.
- Admin accounts use unique passwords and two-factor sign-in.
- Plugins and themes are updated. See website maintenance cost.
How cense handles PDPA on a website
cense's organic leads add-on stores enquiries in the client's own cloud database with the source page and consent records. Our own privacy page is at /privacy. A free website analysis is sent on WhatsApp within 2 working days. See web design in Singapore for what a build includes.
Does the PDPA apply to a website contact form?+
Yes. A name, phone number or email typed into a form is personal data, so the consent, notification, protection and retention obligations apply to it.
Do I need a cookie banner in Singapore?+
PDPC guidance says consent is not needed for cookies that do not collect personal data, or for cookies needed for an activity the user clearly requested. Consent is required where cookies collect personal data to target advertisements.
Must a website show a data protection officer contact?+
PDPC lists designating a DPO and making the DPO's business contact information available to the public under the Accountability Obligation. A privacy page is the usual place for it.
How fast must a data breach be reported to the PDPC?+
Assess whether the breach is notifiable within 30 calendar days of having credible grounds to believe it happened. If it is notifiable, notify the PDPC no later than 3 calendar days after that assessment.
Do WhatsApp marketing messages need a Do Not Call check?+
PDPC guidelines say the Do Not Call provisions apply to messages sent through data applications such as WhatsApp that use a Singapore telephone number. Check the registry within 21 days before sending, unless you hold clear and unambiguous consent in written or other accessible form.
Is this checklist legal advice?+
No. It summarises PDPC publications for website owners. Confirm your own position with a lawyer or the PDPC guidelines.
