Home › Compare laws side by side › PDPA vs EU GDPR
PDPA vs EU GDPR
Personal Data Protection Act 2012 (Singapore) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.
| Topic | PDPA Singapore 10/14 facts confirmed by two sources | EU GDPR European Union (EEA) ✓ Confirmed by two sources |
|---|---|---|
| Status | In force; amended by the PDPA (Amendment) Act 2020 (mandatory breach notification, higher fines). Data portability obligation not yet in force pending regulations.✓ | In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓ |
| Who it applies to | Private-sector organisations that collect, use or disclose personal data in Singapore, whether or not they are based or incorporated there. The public sector and business contact information are excluded.✓ | Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓ |
| Size thresholds | No size threshold. Breach notice to the PDPC is required if significant harm is likely or 500+ individuals are affected. Higher fine cap applies above S$10 million Singapore turnover.✓ | None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓ |
| Regulator | Personal Data Protection Commission (PDPC)✓ | National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓ |
| Breach or incident reporting | Assess a suspected breach within 30 days. Notify the PDPC as soon as practicable and no later than 3 days after deciding it is notifiable. Notify affected individuals as soon as practicable if significant harm is likely. Processors must alert the organisation without undue delay. | Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓ |
| Deadline to answer personal data requests | Respond to access requests as soon as reasonably possible; if you cannot within 30 days, tell the individual in writing within 30 days when you will respond. | 1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓ |
| Data protection officer | Every organisation must designate at least one Data Protection Officer and make its business contact details publicly available. The DPO need not be in Singapore but should be reachable during Singapore business hours.✓ | DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓ |
| Local representative | No local representative requirement.✓ | Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓ |
| Sending data abroad | Transfer only if the recipient gives protection comparable to the PDPA, e.g. via contract (PDPC sample clauses), binding corporate rules, certification, consent after notice, or prescribed cases such as contract performance. PDPC can grant exemptions.✓ | Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓ |
| Cookies and consent | Consent is required unless an exception applies (deemed consent by contract or notification with opt-out, legitimate interests, business improvement). Telemarketing needs consent or a Do Not Call Registry check.✓ | Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓ |
| Maximum penalty | Up to 10% of annual Singapore turnover if that turnover exceeds S$10 million, otherwise up to S$1 million. Criminal offences for reckless disclosure, re-identification and misuse of data.✓ | Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓ |
= confirmed by two independent sources, at least one official.
Facts marked “Being verified” are still being confirmed and are not given as answers.
Who each law applies to
- PDPA
- Private-sector organisations that collect, use or disclose personal data in Singapore, whether or not they are based or incorporated there. The public sector and business contact information are excluded.
- EU GDPR
- Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.
What you must do under PDPA
- Appoint a DPO and publish their business contact details
- Notify purposes and get consent, or document the deemed-consent or legitimate-interests assessment
- Assess breaches within 30 days and notify the PDPC within 3 days of finding them notifiable
- Check the Do Not Call Registry before marketing calls or texts without clear consent
- Use contracts or other safeguards giving comparable protection before transferring data abroad
- Stop using NRIC numbers for login or authentication by 31 Dec 2026
What you must do under EU GDPR
- Identify a lawful basis for every processing purpose and record it.
- Publish a clear privacy notice covering purposes, recipients, retention and rights.
- Keep a record of processing activities and sign Art 28 contracts with processors.
- Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
- Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
- Answer access, erasure and other rights requests within one month.
Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@