Shopify is widely used by Singapore merchants. The Personal Data Protection Act (PDPA) is Singapore's primary data privacy law — enforced by the Personal Data Protection Commission (PDPC).
Disclaimer: This article is for informational purposes only and does not constitute legal advice. PDPA requirements are interpreted and enforced by the PDPC. Consult a qualified lawyer for advice specific to your situation.
PDPA applies to any organization that collects, uses, or discloses personal data in Singapore — regardless of where the organization is incorporated (PDPA s.2(1), definition of "organisation"; PDPC Advisory Guidelines on Key Concepts, "Organisations"). If you:
...PDPA obligations apply to you.
Personal data under PDPA includes anything that identifies a person: name, email address, phone number, shipping address, purchase history, and IP addresses, device identifiers and browsing behaviour where they can be linked to an identifiable customer (PDPC Advisory Guidelines on Selected Topics, paras 7.2–7.5). Your store collects most of this through checkout, customer accounts and analytics.
Check your PDPA compliance before your next campaign. Run a free PDPA scan on your Shopify store → — see which tracker code your homepage serves without a consent mechanism we can detect.
The PDPA requires consent before personal data is collected, used or disclosed — unless an exception applies (e.g., the data is publicly available, or collection is required by law) (PDPA s.13 and First Schedule).
For a Shopify store, this means:
You can only use personal data for the purpose for which it was collected. If a customer gives you their email to fulfill an order, you cannot use that email to send marketing messages unless they've separately consented to marketing.
The PDPA requires you to inform customers what data you're collecting and why — at the point of collection. In practice, this means your Shopify store needs a privacy policy that:
Customers have the right to access the personal data you hold about them and request corrections. Your privacy policy must explain how to exercise this right, and the PDPA expects you to be able to respond to such requests.
Since 1 February 2021, data breach notification is mandatory (PDPA Part 6A, ss. 26A–26E). Where a breach is likely to cause significant harm to the affected individuals, or is of a significant scale (500 or more individuals: s. 26B(1) and reg. 4 of the Personal Data Protection (Notification of Data Breaches) Regulations 2021), PDPA s. 26D(1) requires the organisation to notify the PDPC as soon as practicable, and no later than 3 calendar days after the day on which it assesses that the breach is notifiable. Section 26D(2) also requires the organisation to notify the affected individuals where the breach is likely to cause them significant harm, subject to the exceptions in s. 26D(5) to (7).
By default, a Shopify store loads:
Most of these can collect personal data. The PDPA has no cookie-specific rule, but section 13 bars an organisation from collecting personal data without consent, given or deemed, unless an exception applies, and s.20 requires the purpose to be notified on or before collection. The PDPC's guidance says consent is not needed for cookies that collect no personal data or that support a service the visitor clearly requested (cart, login, security), but it is required where cookies collect personal data for advertising targeting, and a visitor who has simply not changed their browser settings has not consented (Advisory Guidelines on Selected Topics, paras 7.9–7.14). So a tag that collects personal data needs that consent in place before it collects, which in practice means before it fires.
The fix: You need a consent management system on your Shopify store that:
Shopify's built-in cookie banner withholds Shopify's own cookies and Shopify Pixels until consent, but only in regions where it is switched on. By default that is the UK and EEA, so Singapore is not covered until you add it (Settings → Customer privacy → Cookie banner). It does not stop scripts hard-coded in your theme or injected by apps that ignore Shopify's Customer Privacy API; those need custom logic or a consent app that blocks them (Shopify Help Center, "Configuring customer privacy settings").
Consentmo (free plan and paid plans) — a Shopify-native consent app. Its listing shows script auto-blocking, geolocation and the PDPA among the regulations it supports. One Shopify-native option.
CookieYes for Shopify — a Shopify-native app with automatic third-party script blocking listed among its features (free plan available; check current tiers on the listing).
App capabilities and tiers as read on the Shopify App Store listings on 3 October 2026 — verify current features on each app's Shopify listing.
A Shopify default privacy policy template is not sufficient for PDPA. We recommend adding:
If your store serves both Singapore and EU customers, both frameworks apply — independently.
| Aspect | PDPA (Singapore) | GDPR (EU) |
|---|---|---|
| Enforced by | PDPC | National DPAs (e.g. CNIL in France, the German Länder authorities) |
| Maximum fine | Up to 10% of annual turnover in Singapore if that turnover exceeds S$10 million; otherwise up to S$1 million (s.48J(3), for contraventions on or after 1 October 2022) | €20M or 4% of worldwide annual turnover of the preceding financial year, whichever is higher (Art. 83(5)) |
| Breach notification deadline | No later than 3 calendar days after assessing the breach as notifiable (s.26D(1)) | Where feasible, no later than 72 hours after becoming aware (Art. 33(1)) |
| Marketing consent | Opt-in expected (PDPC guidance) | Explicit opt-in required |
| Tracking/cookie consent | Required where the tracker collects personal data, before it collects (unless deemed consent or an exception applies) | Required (ePrivacy Directive) |
| Extraterritorial scope | Yes — any organisation collecting, using or disclosing personal data in Singapore, wherever incorporated | Yes — data of EU residents |
| Right to access personal data | Yes (PDPA s.21) | Yes (GDPR Art. 15) |
The PDPC publishes its enforcement decisions at pdpc.gov.sg. Key patterns from their decisions database:
Sitetals covers both. Run the EU/GDPR scan for your European exposure and the PDPA scan for Singapore.
For broader GDPR/EU context: GDPR fines in 2026: 13 real cases and what they cost. For a complete compliance self-check: the 12 GDPR checks most businesses miss.
Paste your Shopify store URL. The free scan reads your homepage and the privacy or legal page it links to, and shows tracker code served without a consent mechanism we can detect, a missing privacy-policy link and a missing data protection contact.
Full PDF report with PDPC enforcement references and a remediation checklist: from S$68.
Not on Shopify? WooCommerce PDPA compliance for Singapore store operators covers the same ground for a WordPress store. For what we found across the Singapore web, see the Singapore website PDPA health check 2026, and if your company sits outside Singapore, PDPA compliance for foreign businesses operating in Singapore.
Sources: PDPA 2012, ss. 2(1), 13, 20, 21, 26B, 26D and 48J and the First Schedule (consolidated, in force from 5 December 2025) · Personal Data Protection (Notification of Data Breaches) Regulations 2021 (S 64/2021), reg. 4 · PDPC Advisory Guidelines on the PDPA for Selected Topics (revised 23 May 2024), ch. 7 · PDPC Advisory Guidelines on Key Concepts in the PDPA (revised 29 April 2026) · Re SingHealth Services Pte. Ltd. and Integrated Health Information Systems Pte. Ltd. [2019] SGPDPC 3 · Re Goldheart Jewelry Pte. Ltd. [2025] SGPDPC 4 · Shopify Help Center, "Configuring customer privacy settings" (read 3 October 2026) · GDPR Arts 15, 33(1) and 83(5)
Sitetals Editorial