PDPA Compliance Checklist (Singapore)
An email-gated, 60-item compliance checklist covering Singapore PDPA's nine obligations — DPO appointment and BizFile+ registration, consent and notification, DNC, 3-day breach notification, retention and transfer limitation.
What's included
- Professionally drafted, legally reviewed content
- Regulation-specific guidance notes
- Placeholder fields with clear instructions
- Version control and update log
- Customisation guide included
How to use this template
- Walk through the 60 items in order. Each item names the PDPA obligation it maps to (consent, purpose, notification, access/correction, accuracy, protection, retention, transfer, accountability) plus the DNC and breach-notification tracks.
- Mark each item Done / In Progress / Not Started. Use /tools/pdpa-readiness-checker to pre-score the big-ticket items in 10 questions.
- Attach evidence links next to every 'Done' item. The checklist is also the index for an audit evidence pack — screen captures, policies, contracts and system logs.
- Review quarterly and after any PDPC advisory guideline revision.
- When you're ready for the Data Protection Trustmark (DPTM), hand the completed checklist to the DPTM assessor; it maps 1:1 to the DPTM criteria.
Download template
Free to download. Just fill in your details.
Need an automated version of this document? TruePrivacy generates and maintains compliance documents automatically as your data processing activities change.
Try TruePrivacy freeFrequently asked questions
Does the checklist cover the 2021 PDPA amendments?+
Yes — mandatory breach notification (3 calendar days to PDPC, significant harm or 500+ individuals), expanded enforcement powers, and the deemed-consent-by-contractual-necessity provisions.
Is DPO BizFile+ registration enough?+
Registration + a published DPO contact is the baseline. The PDPC's recent enforcement notes (Air Sino-Euro, 2026) show they also look at whether the DPO actually ran the DPA/breach workflow — the checklist tracks the operational scope too.
What's the right cadence for the checklist?+
Quarterly for new or growing programmes; semi-annually once mature. Pin a review to any PDPC advisory guideline revision or major processing change.
Does this cover marketing (DNC) too?+
Yes. The DNC regime is its own section — numbers scrubbing, consent evidence for existing-customer exceptions, and the five-channel marketing message rules.
Can I use this for a data intermediary?+
Partly. Data intermediaries have narrower obligations under the PDPA; roughly 40 of the 60 items apply. Treat the controller-only items as context.
Beyond templates: automated compliance
Static templates are a start. TruePrivacy keeps your privacy documentation accurate and up to date automatically.
Free 14-day trial · No credit card required · Setup in minutes