PDPA for Website Owners in Singapore, Explained

If your website collects names, phone numbers, emails or any other details about identifiable people, Singapore’s Personal Data Protection Act (PDPA) applies to how you collect, use, store and protect that information. In plain terms: tell people what you collect and why, only use it for that purpose, keep it safe, do not keep it longer than needed and know what to do if something goes wrong.

What counts as personal data on a website

Personal data is information about an individual who can be identified, from that data alone or combined with other information. On a typical business site that includes:

Size does not exempt you. The PDPA generally applies to organisations that collect, use or disclose personal data in Singapore, including small businesses and sole proprietors acting for business purposes. Check pdpc.gov.sg for how it applies to your situation.

The core obligations in plain English

The PDPC organises its guidance around a set of data protection obligations. Here is what each means for a website owner. Names and details can change, so confirm them on the official site.

There are also rules about marketing messages sent to phone numbers, covered under the Do Not Call provisions. If you plan to message customers on WhatsApp or SMS for marketing, read PDPA and WhatsApp marketing alongside this guide.

Forms: consent and notification done well

Your contact form is the most obvious place to get this right. A good form tells people why you are asking and what will happen next, without legal jargon.

Keep the form short

Only ask for what you need. If you do not need a home address to answer an enquiry, do not ask for it. Fewer fields mean less data to protect and a higher chance people finish the form.

Separate optional marketing from the enquiry

If you want to send newsletters or promotions, ask separately with an unticked box. Do not bundle marketing consent into the same tick as an enquiry. Keep a record of when and how someone agreed.

Remember chat and WhatsApp

Messages people send through chat or WhatsApp also contain personal data. Treat them the same way: use them to answer the enquiry, restrict who can see them and delete them when no longer needed.

A privacy policy that people can read

A privacy page is usually a good idea. It should say, in plain language, what you collect, why, who it may be shared with, how long you keep it, how to ask for access or correction and how to contact you. Avoid copying a policy from an unrelated company. It will not match what you actually do.

Third-party tools: you are still responsible

Analytics, chat widgets, booking tools, email platforms and ad pixels often collect data on your behalf. Using them does not move your responsibility to the tool. Under the PDPA, an organisation generally remains responsible for personal data that a data intermediary processes for it, and should have appropriate arrangements in place. Check the current guidance on pdpc.gov.sg.

Questions to ask about any tool

• What data does it collect and where is it stored?
• Does it use the data for its own purposes?
• Can I delete data on request?
• Who on my team has access?

Cookies and tracking deserve their own attention. See the cookie consent guide.

Keep it safe, and keep it only as long as needed

Reasonable security

You are expected to take reasonable steps to protect data. For a small business that usually means common sense basics: strong unique passwords, two-step login, limited access, updated software and trusted providers. See website security basics.

Retention

If you no longer need an old enquiry for business or legal reasons, delete it or anonymise it. Decide a simple rule, such as reviewing and clearing old enquiries on a regular schedule, and write it down. Some records have to be kept for other legal reasons, so check what applies to your trade.

Who is responsible: the data protection officer

Organisations are generally expected to designate at least one person to be responsible for PDPA compliance, often called a Data Protection Officer (DPO). For a small business this is typically the owner or a manager. Their business contact details should be available to the public, for example on your privacy page. The PDPC offers resources on this role, so check pdpc.gov.sg for the current expectations.

If something goes wrong: breaches

A data breach could be a lost phone with customer chats, a hacked website or an email sent to the wrong people. The PDPA includes a data breach notification requirement for certain breaches. Whether a breach must be reported depends on factors such as its seriousness and scale, and the timing rules are set by the PDPC. Check the current rules at pdpc.gov.sg.

Write down who does each step before you need it. A plan made during a crisis is slower and more error-prone.

Your PDPA action plan

A mini scenario

Siti runs a small bridal studio. Her site has an enquiry form, a WhatsApp button and a newsletter signup. She adds a sentence under the form explaining the use of the details, makes the newsletter tick box separate and unticked, publishes a short privacy page with an email contact, and sets a calendar reminder to clear old enquiries. It took an afternoon and none of it needed a lawyer. For anything unusual, such as collecting health or children’s data, she would check pdpc.gov.sg and take professional advice.

Common mistakes

• Collecting more fields than needed “just in case”.
• Using an enquiry email address for unrelated promotions.
• Forgetting that chat and WhatsApp messages are personal data too.
• Copying a privacy policy that does not match your practices.
• Having no idea who has the website logins.

Practical examples by business type

• Clinic or aesthetic practice. Enquiries may mention health concerns. Treat that as more sensitive: collect the minimum, restrict who sees it, and check pdpc.gov.sg and any professional body guidance.
• Tuition centre. You may hold details about children. Be especially careful, ask for only what you need and tell parents plainly how it is used.
• Home services. Names, phone numbers and addresses for site visits. Keep job details in one controlled place and clear old ones.
• Online shop. Delivery addresses and order history. Use a reputable payment provider rather than storing card details yourself.

Photos and reviews of real people

Before you post a customer photo or a named testimonial on your site, get clear permission for that use. A written or recorded yes is better than an assumption. Remove it on request where reasonable.

Staff and job applicants

If your site has a careers form, applicants’ CVs are personal data too. Keep them only as long as the hiring need lasts, and limit who can open them.

Website.sg can build your website and set up forms, chat and WhatsApp follow-up, but your privacy notices and policies remain your responsibility, so check the PDPC site. See the plan, and read PDPA and WhatsApp marketing, cookie consent and website security basics.