Insight · PDPA

Your marketing team uses personal data every day. Has anyone read the PDPA?

Singapore's Personal Data Protection Act applies to almost everything a marketing team touches. Penalties run to the higher of SGD 1 million or 10 percent of annual SG turnover. Here's the eight-step checklist a Singapore marketing operator can implement in a month, the B2B exemption most teams misread (and the behavioural-data nuance inside it), and the breach patterns the PDPC actually fines.

$Gary McRae, fractional CMO based in Singapore, PMC and CAIG accredited$

By Gary McRae

12+ years APAC · PMC + CAIG accredited · Singapore

Last reviewed 29 April 2026 · 11 min read

Most marketing teams in Singapore know there is a thing called the PDPA. Most have never actually read it. The gap between knowing and reading is where the breach happens, and where the PDPC fines show up in the named-and-shamed enforcement decisions every quarter.

This is the working operator’s guide. Not legal advice (talk to an actual lawyer for that), but a practical map of what your team has to do, what the carve-outs are, and which patterns the regulator already considers settled. The goal: a Singapore marketing team that can pass an audit on a Tuesday afternoon without panic.

The mistake most marketing teams make

The single most common error is treating the PDPA as a consent-banner problem. Add a checkbox at form submission, write a privacy policy, done. PDPA is in fact nine separate obligations running in parallel: consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation, and accountability. The checkbox covers one of the nine.

The second-most-common error is misreading the B2B exemption. There is a B2B carve-out, but it sits inside the Do Not Call Provisions only. The core Data Protection Provisions still apply to any personal data your team holds, including a sales contact’s name attached to a corporate email. Most “we’re B2B so PDPA doesn’t apply to us” conversations end at the first PDPC information notice.

There is a deeper nuance inside the B2B exemption itself. The category that genuinely sits outside core consent obligations is Business Contact Information (BCI): name, job title, work email, work phone, used in the individual’s role as an employee. Behavioural data is a different animal. Email click tracking, behavioural lead scoring, lookalike audience profiling, AI-personalisation models trained on B2B engagement patterns, all of these are processing of personal data and need explicit consent under the core PDPA, even if the underlying contact details are BCI. The BCI exemption covers static identity, not behavioural inference drawn from it.

The PDPA-for-Marketing Operating Checklist

Eight components. Implementable in a month if your data flows are clean; longer if they’re not. Each component is the answer to a specific question PDPC will ask if you ever face an enforcement action.

01
Appoint a Data Protection Officer (DPO) and publish their contact
Every organisation handling personal data in Singapore must appoint a DPO. The role is statutory, not advisory. Publish the DPO's contact (an email is sufficient) on your privacy policy page. For SMEs, this is usually the founder, the head of operations, or the marketing leader, the law doesn't require a specialist hire.
02
Map your personal-data flows end to end
List every system that touches personal data: web forms, CRM, email tool, ad platforms, lookalike audience exports, vendor lists, support inbox. For each, name what data, why it is held, where it lives, and who can see it. The map is the artefact PDPC asks for first in any enforcement action.
03
Get clear, affirmative consent at every collection point
No pre-checked boxes. No bundled consents (one tickbox covering five different uses). Each purpose, marketing, profiling, AI personalisation, third-party sharing, needs its own checkbox or a clearly worded consent statement. Document the consent: timestamp, IP, what was shown, what was ticked.
04
Honour the eight individual rights without friction
Access, correction, withdrawal of consent, deletion (where consent is the legal basis), purpose-limitation enforcement, accuracy correction, transfer-restriction protection, accountability transparency. PDPC expects responses within 30 days. A buried "data request" mailbox that nobody monitors is a finding waiting to happen.
05
Treat overseas transfers as a real obligation
Most marketing tools (email platforms, ad networks, AI services) process data outside Singapore. PDPA requires a "comparable level of protection" via contract clauses or recognised certifications. Free-tier ChatGPT processing customer emails is the textbook breach. Enterprise-tier with a Data Processing Addendum (DPA) is acceptable.
06
Plan for the 72-hour breach notification window
Notifiable breaches (significant harm or 500+ affected individuals) must be reported to PDPC within 72 hours of discovery. Affected individuals must also be notified unless an exception applies. Pre-write the playbook: who calls whom, who drafts the notice, who pulls the audit logs. Discovering this on the day is too late.
07
Treat the DNC and Spam Control Act as separate obligations
The Do Not Call Registry and the Spam Control Act sit alongside the PDPA. DNC mostly applies to messages to consumers in Singapore (calls, texts, faxes); Spam Control Act applies to electronic messages with a Singapore link. Both require unsubscribe mechanisms and 30-day grace periods. B2B-to-corporate communication has carve-outs but the carve-outs are narrower than most teams assume.
08
Stop using NRIC by 31 December 2026
PDPC's NRIC guidance ends generic NRIC use for authentication or identification by end-2026. Marketing forms, gated content, event sign-ups, none of these can require NRIC. Replace with email + verification code, or a self-issued reference number. Audit your forms now; the deadline is hard.

The breach patterns the PDPC actually fines

Pre-ticked consent boxes. Or one tickbox covering five different uses. PDPC has been clear since 2017: consent must be specific and affirmative. The newer guidance on AI personalisation makes this stricter, not looser.
Repurposed data. Customer service contacts moved into a marketing list without fresh consent. Sales pipeline contacts pushed into a nurture sequence. Common, and one of the highest-frequency findings.
Purchased or scraped lists. Vendor-supplied B2B databases cannot transfer consent. A list bought from a directory provider may legally exist; it does not grant your team marketing rights to its contents.
Overseas transfers without protection. Marketing data flowing to a US-only vendor with no DPA, or to a tool that processes via a region not covered by your contract. Free-tier AI tools sit squarely in this pattern.
Slow or absent breach response. The 72-hour clock starts on discovery. Teams that wait to investigate before notifying PDPC tend to find that 72 hours has already passed by the time the conversation moves up the chain.
Unhonoured opt-outs. Withdrawal of consent must be processed within a reasonable time (10 days for marketing in practice; 30 days under the Spam Control Act). Marketing automation that keeps sending after unsubscribe is a finding the PDPC takes seriously.

How PDPA fits with the broader Singapore framework

PDPA does not sit alone. For marketing teams, three other regimes operate in parallel:

Spam Control Act. Governs unsolicited electronic messages with a Singapore link. Applies broadly to email, SMS, MMS. Requires unsubscribe mechanisms and clear sender identification, regardless of whether PDPA’s DNC carve-outs apply.
Do Not Call Registry. PDPA Parts 9-9A. Mostly relevant for consumer phone, text, and fax outreach. The DNC carve-out for B2B applies here, not to the broader PDPA.
IMDA AI governance frameworks. Voluntary today, but an increasing source of enforcement reference. The Model AI Governance Framework (2024) and the Agentic AI Framework (2026) both intersect with PDPA when AI uses personal data. Covered separately in the AI Governance Framework pillar.

A Singapore marketing team cannot comply with one and ignore the others. The Operating Checklist above is sequenced so that the PDPA work also satisfies most of the Spam Control Act and most of the IMDA voluntary frameworks; that is the design.

When does this stop being a marketing problem?

Two thresholds change the conversation:

When you handle health, financial, or NRIC-equivalent data. At that point this is no longer a marketing-team checklist; it is a privacy-engineering programme that needs a dedicated DPO, external counsel, and likely external assessment. Specific sectoral rules (MAS, MOH) layer on top of PDPA.
When you operate cross-border at scale. GDPR, US state laws, ASEAN Personal Data Protection rules, and Korean PIPA all interact. A marketing team running campaigns across SEA needs a transfer-impact assessment, not just a PDPA checklist.

If neither threshold applies, the eight-component checklist above is sufficient. Implement in a month, audit quarterly, refresh annually.

Frequently asked questions

Does PDPA apply to B2B marketing in Singapore?

Largely yes, with two layers of nuance. The Do Not Call Provisions (Parts 9-9A) generally exclude B2B-to-corporate messages. Business Contact Information (BCI) — work name, title, email, phone used in the role — sits outside core consent obligations. But behavioural data drawn from those contacts (email click tracking, lead scoring, lookalike profiling, AI-personalisation models) is processing of personal data and needs consent. And the rest of the Data Protection Provisions (Parts 3-6A) — security, accuracy, retention, transfer, accountability — apply regardless. Treating B2B as 'PDPA doesn't apply to us' is a common breach pattern.

Can I send cold email to corporate addresses without consent?

Deemed consent applies to business contact information used for business purposes related to the recipient's role. Personalised, business-relevant outreach to corporate emails generally qualifies. Personal emails do not. Purchased lists do not (vendor cannot transfer consent). Honour unsubscribes within 10 days. Cite the PDPC Advisory Guidelines on Requiring Consent for Marketing if you ever need to defend the practice.

What are the actual penalties for a PDPA breach?

The maximum financial penalty is the higher of SGD 1 million or 10 percent of annual Singapore turnover. The 10 percent rule applies to organisations with SG turnover above SGD 10 million; for smaller organisations, SGD 1M is the cap. So for an MNC or a well-funded scale-up, the actual exposure can be far above SGD 1M. Egregious cases attract criminal fines and director liability. The PDPC also publishes named enforcement decisions, so reputational damage compounds the financial penalty in a small market.

Do I need to notify PDPC about every data breach?

No, only notifiable breaches: those that result in significant harm to affected individuals, or that affect 500 or more individuals. The threshold has been in force since the 2020 PDPA amendments. The notification window is 72 hours from discovery. Most marketing-team breaches (a misaddressed email, a misconfigured form) won't meet the threshold but should still be logged internally.

Is using ChatGPT for customer copy a PDPA breach?

Depends on the tier and the data. Free ChatGPT (consumer tier): yes, almost always, because OpenAI may train on the data and processing happens outside Singapore without a Data Processing Addendum. ChatGPT Enterprise or Team with a signed DPA and Asia data residency: acceptable, with explicit consent for AI-based personalisation. The issue is the account configuration, not the tool.

How does the NRIC change affect marketing forms?

From 31 December 2026, you cannot collect or use NRIC for general authentication or identification. Marketing forms, gated whitepaper downloads, event registrations, and mailing-list signups must remove the NRIC field. Replace with email plus verification code, a self-issued customer reference, or, if regulatory rules require strong identity verification (e.g. financial services), use Singpass or a recognised eKYC vendor.

Sources

This article is general information for marketing operators in Singapore, not legal advice. For situations involving named enforcement actions, sectoral rules (MAS, MOH), or cross-border data transfers, consult a Singapore-qualified data-protection lawyer.

Implement the checklist with a fractional CMO who has done it.

A 30-minute discovery call. We’ll map your team’s actual PDPA exposure and prioritise the components that close the biggest gaps first.

Book a discovery call See the Advisory shape