DPDP Act vs Singapore's PDPA: Taking Your Programme Into Asia
An Indian company with a DPDP programme already has most of what Singapore's PDPA asks for, but breach triage, transfers back to India, a DPO and Do Not Call checks are new work.
- CATEGORY
- Article · Singapore PDPA
- POSITION AS OF
- October 2026
- READING TIME
- 9 min read
- TAGS
- Singapore PDPA, DPDP Act, Cross-border compliance, SaaS, Indonesia
Introduction
An Indian company opening in Singapore usually arrives with a programme built for India's Digital Personal Data Protection Act, 2023 (the DPDP Act), whose main duties commence on 13 May 2027. The question is how much of it works abroad.
Singapore's Personal Data Protection Act 2012 (the PDPA) is the natural first comparison. In force in stages since 2013, it was amended in 2020 (Act 40 of 2020) to add deemed consent by notification, a legitimate interests exception, mandatory breach notification (from 1 February 2021) and turnover-linked penalties (from 1 October 2022). The Personal Data Protection Commission (PDPC) enforces it.
The vocabulary maps closely. A DPDP data fiduciary decides why and how personal data is processed and a data processor acts for it; the PDPA says organisation and data intermediary, Indonesia's law controller and processor. Trayambic's GDPR whitepaper ran the other way, into India.
The legal position
Who the PDPA binds. "Organisation" covers bodies formed outside Singapore with no office there (s.2(1)), but not public agencies (s.4(1)(c)). A data intermediary processing for another organisation under a written contract owes only protection (s.24), retention (s.25) and breach alerts (s.4(2)); the organisation answers for it (s.4(3)). Business contact information is largely excluded (s.4(5)).
Grounds. Consent is the default (s.13), but it can be deemed: by conduct, where a person voluntarily provides data (s.15(1)); along disclosures reasonably necessary for a contract (s.15(3), (6)); or by notification, after an assessment, notice and a reasonable opt-out period (s.15A). Under s.17 and the First Schedule, legitimate interests justify processing without consent if they outweigh any adverse effect, after an assessment that identifies and mitigates that effect, and with reasonable access to information for the person (Part 3). They do not extend to messages sent for the purposes the Do Not Call rules cover (para 1(4)). Part 5 permits using data to improve or develop goods and services where identifiable data is needed.
Breaches. A breach is notifiable if it causes or is likely to cause significant harm, or is of significant scale (s.26B(1)): 500 or more people (Notification of Data Breaches Regulations 2021, reg 4). After an assessment made "in a reasonable and expeditious manner" (s.26C(2)), the PDPC must be told "no later than 3 calendar days after the day the organisation makes that assessment" (s.26D(1)), and individuals where significant harm is involved (s.26D(2)), subject to exceptions for effective remediation, prior technical measures and law-enforcement or PDPC instructions (s.26D(5), (6)). Intermediaries alert their organisation "without undue delay" (s.26C(3)(a)).
Other duties. Every organisation designates a person responsible for compliance and publishes contact details (s.11(3), (5)). Transfers out must keep protection "comparable to the protection under this Act" (s.26(1)); the Personal Data Protection Regulations 2021 accept legally enforceable obligations, such as contract terms or binding corporate rules, or specified certifications. Data portability (Part 6B) "will take effect when the Regulations are issued", says the PDPC. Before marketing to a Singapore number, a sender must confirm that the number is not on the Do Not Call (DNC) registry (s.43). Part 9 applies if the sender is in Singapore or the recipient reads the message there (s.38), and PDPC guidance exempts clear consent, ongoing relationships and business-to-business messages.
Penalties. Up to 10% of annual Singapore turnover where it exceeds S$10 million, otherwise S$1 million (s.48J(3)), since 1 October 2022; DNC breaches up to S$1 million for organisations (s.48J(4)).
The DPDP side. Consent or a closed list of legitimate uses, with no legitimate interests ground (ss.4, 6, 7); every breach to the Data Protection Board of India and each affected person, with a 72-hour report (Rule 7); transfers open unless a country is restricted, and none is (s.16).
| Issue | DPDP Act and Rules | Singapore PDPA |
|---|---|---|
| Status | Main duties from 13 May 2027 | In force |
| Grounds | Consent or listed uses (ss.4, 6, 7) | Consent, deemed consent or exceptions incl. legitimate interests (ss.13, 15, 15A, 17) |
| Processors | Contract; fiduciary answerable (s.8(1), (2)) | Intermediary owes protection, retention, alerts (s.4(2)) |
| Breach trigger | Every breach | Significant harm, or 500 or more people (s.26B) |
| Breach timing | Without delay; Board report in 72 hours (Rule 7) | PDPC within 3 days of assessment (s.26D) |
| Accountable person | DPO for SDFs only (s.10); others a contact (s.8(9)) | Every organisation (s.11(3)) |
| Transfers out | Open unless restricted (s.16) | Comparable protection (s.26) |
| Portability | None | Enacted, not in force (Part 6B) |
| Marketing | TRAI regulations, outside the Act | DNC registry (Part 9) |
| Maximum fine | Per obligation, highest ₹250 crore (security safeguards) | 10% of Singapore turnover above S$10 million, else S$1 million (s.48J) |
Elsewhere in Asia. Three laws checked against official texts:
| Law | Points that differ most from the DPDP Act |
|---|---|
| Indonesia, Law 27 of 2022 | Two-year transition to October 2024 (Art. 74); reaches processing abroad with legal effect in Indonesia (Art. 2); six bases incl. legitimate interests (Art. 20(2)); written notice to data subjects and the agency within 3 x 24 hours (Art. 46(1)); transfers need equal protection, binding safeguards or consent (Art. 56); fines up to 2% of annual revenue (Art. 57(3)) |
| Vietnam, Law No. 91/2025/QH15 | In force 1 January 2026; fines up to 5% of prior-year revenue for cross-border breaches, ten times the proceeds of trading in data, VND 3 billion otherwise (Art. 8) |
| Japan, Act on the Protection of Personal Information | Consent for third-party provision, with an opt-out route closed to sensitive data (Art. 27); consent for transfers abroad unless the country or recipient meets the regulator's standards (Art. 28); leak reports in cases set by rules (Art. 26) |
Analysis
What carries over from a DPDP build
| DPDP build | In Singapore | In Indonesia |
|---|---|---|
| Itemised notices, consent records (s.5; Rule 3) | Reuse; deemed consent may lighten flows | Reuse; consent must be explicit (Art. 20(2)(a)) |
| Security and logs (s.8(5); Rule 6) | Reuse (s.24) | Reuse; health data is specific data (Art. 4(2)) |
| Breach runbook (Rule 7) | Adjust: harm-and-scale test, three-day clock | Adjust: 3 x 24 hours |
| Processor contracts (s.8(2)) | Reuse; add intermediary alerts | Reuse; instructions only (Art. 51(1)) |
| Erasure (s.8(7)) | Reuse (s.25) | Reuse |
| Contact person (s.8(9)) | Add a DPO (s.11(3)) | Add an officer if Art. 53(1) applies |
| Open outbound transfers (s.16) | Add transfer terms (s.26) | Add an Art. 56 basis |
| TRAI marketing rules | Add DNC checks (s.43) | Not covered here |
Grounds: room abroad, discipline at home
A DPDP consent flow is lawful in Singapore, just stricter than needed. Section 15(1) resembles the DPDP Act's s.7(a), on data voluntarily provided for a specified purpose, but Singapore adds contractual chains, opt-out notification and business improvement. The risk runs back to India: a group policy that justifies analytics or fraud screening by a Singapore assessment must not migrate to Indian users. In our view the cleanest control is one register of purposes with a ground recorded per country. Trayambic's article on s.7 legitimate uses sets out the Indian options.
Breaches: one incident, different gates
India has no gate: every breach is reported, and in Trayambic's view the clock runs from the fiduciary's awareness. Singapore filters by harm and scale, and its three days run from an assessment that must itself be prompt. Indonesia's Art. 46(1) does not say when its 3 x 24 hours start, so in our view plan from discovery. CERT-In's six-hour report still applies to cyber incidents in India. For a vendor, the hinge is the intermediary's alert: a client cannot assess what it has not heard about. Trayambic's "One Incident, Many Clocks" framework covers sequencing.
Transfers: India is open, its neighbours are not
The DPDP Act sets no conditions for data leaving India (s.16), but Singapore and Indonesia regulate data leaving them, including to India. Because s.4(2) lifts the s.26 duty from intermediaries, it sits with the Singapore organisation; in our view an Indian vendor meets it through the client's contract, not as its own statutory duty. Indonesia places it on the controller (Art. 56). In our view, treat support access from India as covered by those terms even where data is hosted in Singapore.
People, marketing and money
Teams used to the DPDP Act's SDF-only DPO often miss that every Singapore organisation needs one. Indonesia requires an officer from controllers and processors alike for public services, large-scale monitoring or large-scale processing of specific data (Art. 53(1)). DNC rules reach messages read in Singapore, so a campaign run from Bengaluru is covered. And fines scale differently: India's ceilings are fixed per obligation, while a Singapore subsidiary with S$30 million turnover (illustrative) faces up to S$3 million.
Practical implications
Worked example (illustrative). A Pune company sells clinic-management and patient-messaging software to 600 Indian clinics and labs. In 2027 it signs 80 clinics in Singapore through a local subsidiary and 25 in Jakarta. Patient data for both sits in a Singapore cloud region; support and engineering are in Pune.
- Roles. For patient records it is a data intermediary in Singapore and a processor in Indonesia; for its own customer and prospect data, an organisation and controller.
- India. Pune's access is processing in India of non-residents' data under contracts with clinics abroad, so s.17(1)(d) removes most of the DPDP Act, but accountability and security (s.8(1), 8(5)) remain. Rule 6 controls stay on every dataset; Trayambic's GCC study covers the conditions.
- Contracts. Each clinic agreement gains a transfer schedule (s.26; Art. 56), breach alerts within 24 hours (an illustrative target), deletion on exit and processing only on instructions.
- Breaches. The runbook branches: alert the clinic first; Singapore clinics file within three days of assessment, Indonesian clinics within 3 x 24 hours; CERT-In within six hours where Indian systems are hit.
- People. The subsidiary designates a DPO (s.11). Health data being specific data in Indonesia, the company tests whether its processing is large-scale enough to need an officer (Art. 53(1)(c)).
- Messaging. Health-screening promotions that Singapore clinics send through the product need a DNC check unless the patient gave clear consent or has an ongoing relationship with the clinic, so the product adds a registry check and a consent flag.
| Action | Singapore | Indonesia | DPDP link |
|---|---|---|---|
| Tag datasets by country and role | s.4(2), (3) | Arts 51, 53 | s.17(1)(d) |
| Add transfer schedules to contracts | s.26 | Art. 56 | s.16 |
| Set client breach alerts in hours | ss.26C, 26D | Art. 46(1) | Rule 7 |
| Name the accountable person | s.11(3), (5) | Art. 53(1) | s.8(9) |
| Record a ground per purpose and country | ss.15, 15A, 17 | Art. 20(2) | ss.4, 7 |
| Add DNC checks for promotions | ss.38, 43 | Not covered | TRAI rules |
Key takeaways
A DPDP programme is a strong base for Singapore and Indonesia: notices, security, contracts and erasure carry over. The new work is a harm-and-scale breach assessment, transfer terms for data flowing back to India, a designated DPO and DNC checks. Guard the border in the other direction too: Singapore's deemed consent and legitimate interests must not leak into processing of Indian users.
- Singapore's PDPA binds organisations formed abroad; an Indian vendor processing for Singapore clients under a written contract is a data intermediary with protection, retention and breach-alert duties.
- The PDPA allows deemed consent (including by notification) and a legitimate interests exception; the DPDP Act has neither, so grounds must be recorded per country.
- Singapore requires breach notice only for significant harm or 500 or more people, to the PDPC within 3 calendar days of assessment; India requires notice of every breach, and Indonesia notice within 3 x 24 hours.
- Singapore and Indonesia restrict transfers out, including to India, and fines reach 10% of Singapore turnover (above S$10 million) or 2% of annual revenue in Indonesia.
- Every Singapore organisation needs a designated DPO and, unless an exemption such as clear consent applies, must check the Do Not Call registry before marketing to Singapore numbers; the data portability obligation is not yet in force.
Anonymisation and Pseudonymisation Under the DPDP Act
The DPDP Act never mentions anonymisation, so whether a dataset escapes it turns on one word in section 2(t), 'identifiable', and on who could do the identifying.
SDKs, Pixels and Trackers: Who Is Responsible Under the DPDP Act?
Every SDK in an app sends data to someone, and the DPDP Act holds the app answerable for what its code collects while making a vendor that uses the data for itself answerable too.
Age Assurance Under the DPDP Act: Knowing Who Is a Child
The DPDP Act makes businesses treat children differently but never tells them to check every user's age, so the answer lies in matching the check to the risk and keeping the result, not the evidence.