Is your website PDPA compliant?

Three things a website shows on its face. Section 20 requires you to inform individuals of the purposes for collection on or before you collect their personal data — a published privacy policy is the ordinary way a website does that. Section 11(3) requires a designated individual responsible for compliance, and section 11(5) requires that person's business contact information to be published. Collection through trackers needs consent. The PDPA privacy policy checklist →

Yes. Every organisation subject to the PDPA must designate at least one individual responsible for compliance under section 11(3), and there is no small-business exemption. A second, separate duty under section 11(5) requires you to publish that person's business contact information; regulation 1A also allows it to be filed on ACRA's BizFile instead. Designation does not transfer your liability — section 11(6) says so in terms. Appointing and publishing a DPO →

The PDPA does not use the word “cookie”. It regulates the collection of personal data, whatever the technology is called. You need consent — given or deemed — before collection for any tracker that collects personal data, which most analytics and advertising tags do. Deemed consent under section 15 rarely stretches to third-party analytics and advertising, so in practice those need a mechanism. A banner that appears after the tags have already loaded records a click, not a consent. Cookie banners under the PDPA →

The PDPA can apply to a business with no presence in Singapore. It follows the activity, not the incorporation: if you collect personal data in Singapore it applies, with no office, no entity and no local server required. Your data protection officer does not have to be in Singapore either — section 11(3) requires a designated individual and says nothing about residence. GDPR compliance does not carry over. PDPA for businesses outside Singapore →

Yes, subject to conditions. The PDPA does not ban sending personal data overseas — section 26 permits it subject to prescribed requirements. Regulation 10(1) requires you to take appropriate steps to ascertain and ensure the recipient is bound by legally enforceable obligations providing protection at least comparable to the Act: law, a contract meeting regulation 11(2), binding corporate rules, or another legally binding instrument. There is also a certification route: as of 2 March 2026 it covers the Global CBPR and Global PRP systems as well as the APEC ones. Cross-border transfers under the PDPA →

The free scan reads the pages your server returns and reports what is externally visible: whether a privacy policy can be found, whether a data protection contact is published on the site, and whether tracker code loads with no consent mechanism present. A finding is something we could see from outside; it is not a determination that the PDPA has been contravened. Sitetals is an independent compliance research service, not a law firm, and its reports are not legal opinions. For formal legal advice, consult a qualified practitioner familiar with the PDPA.