Personal Data Protection Act 2012 · 2020 Revised Edition · Part 3 · General Rules with Respect to Protection of and Accountability for Personal Data
11. Compliance with Act
Feedback & supportIn plain English
An organisation must consider what a reasonable person would find appropriate in the circumstances. An organisation is responsible for personal data it holds or controls. An organisation must name one or more individuals responsible for compliance. The organisation must publish business contact details for at least one of them. Naming them does not free the organisation of its duties.
Summary · Drafted with AI, checked against the official text on 30 Sep 2026.
Last amended by an amending law of 2020.
In meeting its responsibilities under this Act, an organisation must consider what a reasonable person would consider appropriate in the circumstances.
organisation
“organisation” includes any individual, company, association or body of persons, corporate or unincorporated, whether or not —(a)formed or recognised under the law of Singapore; or(b)resident, or having an office or a place of business, in Singapore;
An organisation is responsible for personal data in its possession or under its control.
personal data
“personal data” means data, whether true or not, about an individual who can be identified —(a)from that data; or(b)from that data and other information to which the organisation has or is likely to have access;
An organisation must designate one or more individuals to be responsible for ensuring that the organisation complies with this Act.
An individual designated under subsection (3) may delegate to another individual the responsibility conferred by that designation.
An organisation must make available to the public the business contact information of at least one of the individuals designated under subsection (3) or delegated under subsection (4).
business contact information
“business contact information” means an individual’s name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his or her personal purposes;
Without limiting subsection (5), an organisation is deemed to have satisfied that subsection if the organisation makes available the business contact information of any individual mentioned in subsection (3) in any prescribed manner.
The designation of an individual by an organisation under subsection (3) does not relieve the organisation of any of its obligations under this Act.