Singapore · 7 min read
Consent, purpose, DPO details, marketing consent and breach duties: how Singapore’s PDPA shapes the enquiry forms and portals on a business website.
By Chris ·
Every enquiry form on your website collects personal data. In Singapore, that means it falls under the Personal Data Protection Act 2012 (PDPA), enforced by the Personal Data Protection Commission (PDPC).
This is not legal advice, and your firm’s own advisers should confirm what applies to you. It is a practical look at where the PDPA touches a website, and what a carefully built site does about it.
The obligations that matter on a website
The PDPA sets out a series of obligations. These are the ones a website runs into most directly:
| Obligation | What it means for your website |
|---|---|
| Consent | Collect, use or disclose personal data only with consent (or where an exception applies). |
| Notification | Tell people why you are collecting their data, at or before the point of collection. |
| Purpose limitation | Use the data only for purposes a reasonable person would consider appropriate. |
| Protection | Make reasonable security arrangements for the data you hold. |
| Retention limitation | Do not keep personal data longer than you need it. |
| Accountability | Designate a Data Protection Officer and make their business contact details publicly available. |
| Data breach notification | Assess suspected breaches promptly and notify the PDPC (and in some cases the people affected) when a breach is notifiable. |
1. Say why, at the point of collection
A link to a privacy policy in the footer is not the same as notification. Beside each form, say briefly what the data will be used for: “We will use these details to respond to your enquiry and, if you instruct us, to open a matter.” Link to the full policy for detail.
2. Ask only for what you need
Many firm websites ask for an NRIC number, a full address or a detailed description of the matter in the first form. Usually none of that is needed to arrange a first conversation. Every field you remove is data you do not have to protect, retain or account for, and the form is more likely to be completed.
The PDPC has issued specific guidance restricting the collection of NRIC numbers. Do not ask for them on a website enquiry form.
3. Keep marketing consent separate
Responding to an enquiry and adding someone to a newsletter are different purposes. Use a separate, unticked checkbox for marketing, record when consent was given, and make withdrawal simple.
If you intend to send marketing messages to Singapore telephone numbers by call, SMS or messaging, the PDPA’s Do Not Call provisions also apply. Your process should check the DNC Registry first.
4. Publish your DPO’s contact details
Organisations must make the business contact information of at least one person responsible for data protection available to the public. The privacy page is the natural place. A dedicated address such as dpo@yourfirm.com.sg survives staff changes better than a personal one.
5. Protect what the website stores
Form submissions often end up in places nobody thinks about: plugin databases, email inboxes, third-party form services, CRM trials that were never switched off. A well-built site:
- Sends submissions over HTTPS and stores them in one known, secured place
- Does not keep copies in a plugin database that no-one reviews
- Restricts admin access by role and logs who viewed what
- Deletes or anonymises submissions after an agreed retention period
6. Design portals for breach readiness
If your website includes a client portal, the PDPA’s data breach notification obligation becomes very practical. Once an organisation has assessed that a breach is notifiable, it must notify the PDPC within three calendar days. You cannot meet that deadline if you cannot tell what was accessed. Access logs, clear data inventories and role-based permissions are what make a fast, accurate assessment possible.
7. The stakes are real
Under the 2020 amendments (with the higher penalty cap in force since October 2022), the maximum financial penalty is 10% of an organisation’s annual turnover in Singapore where that turnover exceeds S$10 million, or S$1 million otherwise. For a professional firm, the reputational cost of a publicised breach is likely to be greater still.
A short checklist for your current site
- Does every form say why the data is collected, right beside the form?
- Have you removed every field you do not genuinely need?
- Is marketing consent separate, unticked and recorded?
- Are your DPO’s business contact details published?
- Do you know every place a form submission is stored?
- Is there a retention period, and is it enforced?
If several of those answers are “not sure”, it may be worth a review. See how we build for Singapore and how we handle forms, portals and data in bookings and systems, or ask us directly.
