PDPA for Associations and Non-Profits in Singapore

Singapore's Personal Data Protection Act (PDPA) applies to every organisation that collects personal data — including clubs, societies, charities, and alumni groups. There's no volunteer-run exemption. The Personal Data Protection Commission (PDPC) has enforced against small organisations for real money.

The work is not actually hard. Most of it is writing down what you already do and making sure a couple of gaps get closed.

The four obligations that matter

1. Consent — collect, use, and disclose data only with valid consent and for the purpose stated
2. Access — let members see what you hold and correct it if wrong
3. Accuracy and protection — keep data accurate and secure
4. Retention — don't hold data longer than you need

Appointing a DPO

Every organisation must appoint a Data Protection Officer. It can be an existing volunteer — the Secretary or Treasurer is a common choice. The DPO's business contact details must be published so members can reach them.

The DPO is responsible for developing and implementing your PDPA policies, handling data requests, and being the point of contact with the PDPC in the event of a breach.

Consent: do it properly once

At sign-up, collect consent that is specific and granular. Don't lump marketing, photo usage, and directory sharing into one checkbox. Each purpose deserves its own opt-in.

• State what you're collecting
• State why you're collecting it
• State who it's shared with (if anyone)
• Give a clear way to withdraw consent later

Data access and correction requests

A member can ask for everything you hold about them, and can ask for corrections. You must respond within 30 days. Charge a reasonable fee if you want — most organisations don't.

Retention and deletion

Once a member leaves and you no longer need their data for a lawful purpose, delete or anonymise it. There's no fixed timer — it's 'as soon as you no longer need it'. A common practical rule: six years after the end of membership, to align with contract and tax record requirements.

If you have a breach

Under the Data Breach Notification obligation, if a breach is likely to cause significant harm or affects 500 or more individuals, you must notify the PDPC within 3 calendar days and affected members as soon as practicable. Not every lost laptop is a reportable breach — but prepare the response plan before you need it.