PDPA Readiness Checker (Singapore)
A 10-question diagnostic that scores your readiness against Singapore's Personal Data Protection Act — covering the nine obligations, DPO appointment, DSR response, 3-day breach notification, and the DNC regime.
Tool details
About this tool
A 10-question diagnostic that scores your readiness for Singapore's Personal Data Protection Act. The questions map to the nine PDPA obligations, DPO appointment and BizFile+ registration, the Do Not Call regime, and the 3-calendar-day mandatory breach notification introduced by the 2021 amendments.
What you'll get
- An overall readiness score with a traffic-light band and a plain-English label.
- A gap list naming the specific PDPA obligation each gap maps to.
- A concrete remediation action for every failed question.
- Deep links to TruePrivacy workflows that automate each obligation.
How it works
- Each 'yes' scores one point. Score ≥ 70% is 'PDPA Ready', 40–69% is 'Partially Ready', below 40% is 'Significant Gaps'.
- The 10 questions cover: DPO + BizFile+, consent, access/correction, DNC, 3-day breach, retention, transfer limitation, DPIAs, vendor DPAs, and the written policy itself.
- Everything runs locally in your browser — no data is sent anywhere.
Based on
- Personal Data Protection Act 2012 (as amended in 2021).
- PDPC Guide to Developing a Data Protection Management Programme.
- PDPC advisory guidelines on mandatory data breach notification.
Have you appointed a Data Protection Officer and registered them on BizFile+?
Every PDPA-covered organisation must appoint at least one DPO and make their contact publicly available. ACRA accepts the DPO filing on BizFile+ at no cost.
Frequently asked questions
Do I need to appoint a DPO even if I have fewer than five employees?+
Yes. Every organisation covered by the PDPA — regardless of size — must appoint at least one Data Protection Officer and make the DPO's contact publicly available. The DPO appointment is filed on BizFile+ at no cost.
What counts as a notifiable breach under the PDPA?+
A breach is notifiable when it affects 500 or more individuals OR is likely to cause significant harm. If either threshold is met you have three calendar days to notify the PDPC and must inform affected individuals as soon as practicable thereafter.
Can the readiness checker be used by a data intermediary?+
Yes. Data intermediaries have narrower obligations under the PDPA, but seven of the ten questions still apply (DPO, consent, protection, retention, transfer limitation, DPAs, breach). Score the whole quiz and treat the controller-only items as context.
Does the checker cover the Do Not Call regime?+
Yes. Question 5 specifically targets DNC scrubbing. The DNC Registry is a separate penalty track under the PDPA and is a common source of enforcement.
What about the DPTM certification?+
The IMDA Data Protection Trustmark is a voluntary certification. If you score 'PDPA Ready' you have the baseline the DPTM assessor will look for; follow the IMDA DPTM checklist to go from readiness to certified.
Other tools you might find useful
Need more than a free tool?
TruePrivacy is a full privacy operations platform. Automate DSRs, consent, vendor risk, and breach response.
Free 14-day trial · No credit card required · Setup in minutes