Terms & Privacy generatorSingapore
Website Privacy Policy (Singapore, PDPA)
A website/app privacy policy compliant with Singapore's Personal Data Protection Act 2012 (as amended), covering consent and legitimate-interests bases, purpose limitation, the mandatory data-breach notification regime, a named Data Protection Officer, and individuals' access/correction rights.
What is a Website Privacy Policy?
A Website Privacy Policy (Singapore, PDPA) is a website/app privacy policy compliant with Singapore's Personal Data Protection Act 2012 (as amended), covering consent and legitimate-interests bases, purpose limitation, the mandatory data-breach notification regime, a named Data Protection Officer, and individuals' access/correction rights.
Any Singapore organisation that collects personal data through a website, app or service. The PDPA requires you to notify purposes, appoint a DPO, and comply with the notification, consent, protection and breach-notification obligations.
Website Privacy Policy template, current for 2026
Reflects the PDPA as amended in 2020/2021: the mandatory data-breach notification obligation to the PDPC and affected individuals, the legitimate-interests and business-improvement exceptions to consent, data portability context, and the enhanced financial penalty framework.
How HDAi does this differently
Unlike a static form, HDAi runs a guided interview and assembles your Website Privacy Policy as you answer. When you want it finished, a licensed Hart David Carson attorney reviews it and tailors it to your facts before you sign. The interview and the first draft are automated. The judgment belongs to an attorney.
What you’ll be asked
A short interview in plain language that asks only what this document needs.
- Which organisation publishes this privacy policy? This is the legal entity that determines the purposes and means of processing personal data (the data controller under the PDPA). Its name and registered address anchor the whole policy.
- Trading name / brand (if different from legal name) If your website or app is marketed under a brand that differs from the registered entity name, we name both so individuals know who they are dealing with.
- Unique Entity Number (UEN) ACRA's UEN identifies your Singapore entity and lets individuals and the PDPC verify who is accountable for their data.
- Primary website / app URL this policy governs Defines the digital properties the policy covers so its scope is unambiguous.
- Does this policy also cover mobile apps or other digital services? The PDPA applies across channels; stating scope avoids the argument that offline or in-app collection is uncovered.
- Effective date of this policy The PDPA expects individuals to know which version governs; the effective date fixes that.
- Name or title of the Data Protection Officer (DPO) Section 11(3) PDPA requires every organisation to designate at least one DPO and make their business contact information available. This is mandatory.
- DPO email address The DPO's business contact must be published so individuals can raise queries, access/correction requests and complaints.
- DPO telephone number A phone contact is good practice alongside email for the mandatory DPO contact channel.
- Postal address for written data-protection requests Access and correction requests and withdrawal notices are often required in writing; a postal address gives individuals a fixed channel.
- What categories of personal data do you collect? Purpose limitation requires you to state what you collect. Note the PDPA's NRIC Advisory Guidelines restrict collecting NRIC numbers, so we flag that separately.
- How do you collect personal data? Individuals must be told the sources of their data; this also drives the deemed-consent and notification sections.
- For what purposes do you use personal data? List each purpose. The Purpose Limitation Obligation (s18) requires collection/use/disclosure only for purposes a reasonable person would consider appropriate and that have been notified. Be specific.
- Do you rely on the legitimate interests exception for any processing? The 2020 amendments added a legitimate-interests basis (First Schedule Part 3). If you rely on it you must conduct and record an assessment and disclose reliance in your policy.
- Describe the legitimate interests you rely on For each legitimate interest you must have concluded the benefit outweighs any adverse effect on the individual. State them so the reliance is transparent.
- Do you disclose personal data to third parties? Disclosure must be for notified purposes. If yes, we list recipient categories so individuals know where their data flows.
- To which categories of third parties do you disclose data? The PDPA holds you accountable for data passed to processors and partners; naming categories satisfies the transparency and protection obligations.
- Do you use data intermediaries (processors) to process data on your behalf? Under the PDPA you remain accountable for data intermediaries and must bind them by contract to protection and retention obligations.
- Do you transfer personal data outside Singapore? The Transfer Limitation Obligation (s26) requires comparable protection abroad. If yes, we state the safeguards you rely on.
- To which countries / regions do you transfer data? Naming destinations supports transparency and shows you have considered the Transfer Limitation Obligation.
- What safeguards do you use for overseas transfers? Section 26 and the Transfer Limitation regulations require legally enforceable obligations that provide comparable protection. Select those you rely on.
- Does the website use cookies or similar tracking technologies? Cookies collect personal data (e.g. via device identifiers), so a cookies section is expected. It also supports consent management.
- What types of cookies / trackers do you use? Categorising cookies lets individuals give or withdraw consent per category and is standard practice.
- Which analytics / advertising tools do you use? (optional) Naming key tools improves transparency about who else may receive data through your site.
- Do you offer an in-product cookie-consent tool for non-necessary cookies? PDPC guidance treats cookie data that identifies an individual as personal data. Where you set analytics, functional or advertising cookies, a consent banner or preference centre lets individuals grant and withdraw consent per category. Selecting Yes states that non-necessary cookies fire only after consent through that tool.
- Do you send marketing communications? Direct marketing engages both the consent rules and Singapore's DNC (Do Not Call) provisions in Part 9 of the PDPA.
- Through which channels do you market? SMS and voice channels engage the DNC Registry rules; email marketing engages the Spam Control Act. We adjust the notice accordingly, so an email-only marketer sees no DNC text.
- How long do you retain personal data, and on what basis? The Retention Limitation Obligation (s25) requires ceasing retention once the purpose is served and no legal need remains. State your approach.
- What security measures protect personal data? (optional) The Protection Obligation (s24) requires reasonable security arrangements. Describing them builds trust and evidences compliance.
- Do you use automated decision-making or profiling that significantly affects individuals? Profiling and solely automated decisions that produce legal or similarly significant effects (for example, automated credit, pricing, eligibility or fraud decisions) should be disclosed so individuals understand the processing and can seek human review.
- Describe the automated decision-making or profiling you carry out Describe the logic and its effect in everyday language so the notice is meaningful, covering the purpose, the categories of data used, and the consequences for the individual.
- Include the mandatory data-breach notification commitment? Since 1 Feb 2021 the PDPA mandates notifying the PDPC (and affected individuals) of notifiable breaches, those causing significant harm or affecting 500+ individuals, within the statutory timeframes. This clause is strongly recommended.
- Include a data-portability clause? The 2020 amendments introduced a Data Portability Obligation allowing individuals to ask that applicable electronic data be transmitted to another organisation. It is not yet fully in force, so the clause is framed to apply once the Obligation and its regulations take effect. Include it if you want to signal readiness.
- Do you knowingly collect data from minors? The PDPC guidance treats minors specially; a policy should state your position on children's data.
- Below what age do you treat an individual as lacking capacity to consent? PDPC guidance indicates that a minor below 13 generally lacks the capacity to give consent on their own behalf, so parental consent should be sought. You may set a higher threshold to match your risk posture. Leave blank to use 13.
- Include an escalation path to the PDPC for unresolved complaints? The usual approach is to invite individuals to contact your DPO first and to tell them they may lodge a complaint with the PDPC if unsatisfied.
- State that Singapore law governs this policy? A governing-law line confirms the PDPA and Singapore law frame the policy and any disputes about it.
Frequently asked
About the Website Privacy Policy and how HDAi works.
What is a Website Privacy Policy (Singapore, PDPA)? +
A Website Privacy Policy (Singapore, PDPA) is a website/app privacy policy compliant with Singapore's Personal Data Protection Act 2012 (as amended), covering consent and legitimate-interests bases, purpose limitation, the mandatory data-breach notification regime, a named Data Protection Officer, and individuals' access/correction rights. Any Singapore organisation that collects personal data through a website, app or service needs one, because the PDPA requires you to notify purposes, appoint a DPO, and comply with the notification, consent, protection and breach-notification obligations.
Is HDAi's Website Privacy Policy (Singapore, PDPA) legally binding? +
A published policy takes effect when you post it and, where your terms require it, when users accept it; how far it binds depends on the way it is presented (an affirmative click beats a footer link) and on the laws of the places your users live. Have a licensed Hart David Carson attorney confirm the presentation and the jurisdictions before you publish.
Do I need a lawyer to use this Website Privacy Policy (Singapore, PDPA)? +
You can generate and download the Website Privacy Policy (Singapore, PDPA) in minutes, free of charge. A licensed Hart David Carson attorney can then review it and tailor it to your facts before you sign, which is the part no template can do.
What makes this Website Privacy Policy (Singapore, PDPA) current for 2026? +
Reflects the PDPA as amended in 2020/2021: the mandatory data-breach notification obligation to the PDPC and affected individuals, the legitimate-interests and business-improvement exceptions to consent, data portability context, and the enhanced financial penalty framework.
How long does the Website Privacy Policy (Singapore, PDPA) take? +
Estimated time about 19 min (37 questions), depending on how much you already know. The document assembles as you answer. Export it as PDF or Word, or send it to a Hart David Carson attorney for review.
Does this Website Privacy Policy (Singapore, PDPA) work in Singapore? +
Yes. This version is drafted for Singapore law and terminology. It is not a relabeled U.S. form. A licensed attorney coordinates with locally admitted counsel where required.
Other jurisdictions
The same document, drafted for another jurisdiction’s law.
Terms & Privacy
Related generators
Website Privacy Policy (UK GDPR / DPA 2018) · Website Privacy Policy (DIFC) · Data-Subject-Request (DSR) Handling Procedure · Email & Marketing Consent (CAN-SPAM + Opt-In) · All 124 →